Analysis
-
max time kernel
144s -
max time network
178s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 13:00
Static task
static1
Behavioral task
behavioral1
Sample
3713212050367cbc83829aec1189674f.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3713212050367cbc83829aec1189674f.html
Resource
win10v2004-20231222-en
General
-
Target
3713212050367cbc83829aec1189674f.html
-
Size
19KB
-
MD5
3713212050367cbc83829aec1189674f
-
SHA1
46681414c15b5b886fb579bb174a922d7e427497
-
SHA256
2f42c40b39694e4822c6e1ffe65f0d5ae59e4a8f7979974fb9a3d1de537c7bae
-
SHA512
35594e8744606fc76cee1b50ffe596fbe06e1e2948dafa219966f13753b96859e914a1968a2484273c1ab00400021d4bc812a92390bd95650846c080ca93aee3
-
SSDEEP
384:S1jbCiJnU/B+obfx1vpoXeiJXx8WErWC4S0HgfatVEBj9RHJP:iJne1XBeeiJB8l6C50HgStWBJRp
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000d94bee0ee3982fa853baff42289be0c289559d59c1ae3dea9f6b427898213932000000000e8000000002000020000000a59ab2ac9daa0dc393d792ad82696b699f1c7118dc1437e70a028f350e085b7f200000000e39f801c40d8d8518b04fbb6eedc13c3c9356d646d53f9dcb18014eb8cc2e8040000000fede007460b786ecebf60f7b3804e6f1fc5951574e7dc1a553fe4d31699eac47dc787ddffec182551544904d611796ade2206ed6405fa080d195b35f10b49c43 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403f2a35473fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{40C50291-AB3A-11EE-B1E2-4A7F2EE8F0A9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410559590" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000e8372fb01ea0d8a49e12359b3e1d7c7333fd9b2f85b08cd23cb62a19ce6db49d000000000e8000000002000020000000aa727978cf48d2872379bfa6bfc86471dee34ac588c46eed92d8855768c5c23b90000000b7f2149b68c210ed3e0efc4affa91ebdaf18e270b45721bdf7be8d9dda344eb802f01c028bf9fdf584648bba4966d9524a626d735c4fc3e4bd6d07c19b5145606c463b9eaf8f272b7c159752817ac450f1618229e617e85a18111a1585851acb58bc771f2858030301bf3a79b905d676e143b53aa0fe1129097b12c7b27388d0b9c3dec33c03504c6cb894b6ec2c736540000000b05ececb453d6761f79ffae01fc266eca0ffc27415478e39d5135ad1ccda272fe1262a8dcf16ff6884cc0553ac4276aa79b61891be3ea1c7ff9d73645ab9bfb9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2716 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2672 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2672 iexplore.exe 2672 iexplore.exe 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2716 2672 iexplore.exe 30 PID 2672 wrote to memory of 2716 2672 iexplore.exe 30 PID 2672 wrote to memory of 2716 2672 iexplore.exe 30 PID 2672 wrote to memory of 2716 2672 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3713212050367cbc83829aec1189674f.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507abfa6a12c53398451eb052605d4f21
SHA1d4f3d61f8363d33e89b26c5f1c770ccdeafa4fdc
SHA256e8f3c3e22dea7c6ecabe3cad0d32fd02c5bdee238d42afc3b2c27517414f3c9e
SHA512bc3d354d8961fa629fedbf643e0649bf92740b5ed3d1d542e4c198fc9694dbef41d10e67d38cfecabf2cf099aac47e0cfc240a912a91d41509a0db31bb2e1aea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bedac5b52957be49862266068ea51fa
SHA124079370f8f724fb66c1d4fd69b96fa8331d12d2
SHA25660d8aa145dbb9fe713810d9be4206b1880701250362127f3e5567feff4f7bf7c
SHA512a642b010debc9c17b35125e3a2d5f9fcd30038fbe22836f1315d8c8d343f3f345df15393a9e66a12e9d5e6991e9d853136368dbc9aa0faef32a264e3fd7dff9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577e29b6a609f267870213fcbfde3f9d8
SHA1bd8e881bc328cd09bf0f583a5f944c4ac22003e1
SHA25693e25d39cd4d06c141ffc86e920a0f37125974330600ecf6ce49f037809325e1
SHA512f07bfe3fea8f941618e4d3d52a68d1c83c2a737fcf19fa514f685555f0b3a6e841956f7ae9dd1a1e22454891bb294c6929af56db16d47f9236b54fa777bcf72f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583271979565ae087a31d167552369c83
SHA10d45ec1c3ca63fefb0edbf6684c1248a00809640
SHA2563432fbf47e445268c21def7cc27201080ada7565fbc6f53610a94cc98250b756
SHA5124f92d24e52367b3643208642b9da4e137cd35c16e2a8fd04c2c5d57f0a9774298cdd0e02a249e1394c708e90d067aee8d819e477fc79f752629f84e1eef8c406
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a8f0fed09c33daeaf6ed8225fb6b8e5
SHA1b63a526b509197c50c005d46dd8682d42971ac30
SHA256fdbae80602d1f040482f265151bb052e50326963724ad40eb58f169370411175
SHA512f50f5215b4f204a2730b41e02ad695a82cebae08c2360027a61afd1cca52a82fb00b293e02934e9306ba9d52d08110d79717a23b769fc544858b9e18917a2a25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab8528671e351e3d73ab2372d2afb527
SHA13fb1871f3ec3559d3925e30e3f641c34502f083c
SHA2567b8d663dece9d5a6001e243fdb541da9dc9156069194edbd0a9972a53335a21a
SHA512ad33d7ba3d1cbf489f3c2cf8f08fee84aa4fe7d50d50536d5d556293ad6e1290019e6801b079927c4eda9c93fc349d22fd0b64018520468f4bbf200a547b2f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506f22756c2dfbb51dd3cdd91b6a947b2
SHA1985917e84c62f03492d7cb68c16142b930dbbb92
SHA256249fabc36ed384a31de21e0c240be9576c09518421404f473fd6cbe5dedd3664
SHA5124bf0ba12b205d217071fed0ac32f4b95ebe139a4dc7096889f985f83cd273de9438327efe5b1220e00ae98a6e8c1f9f10ceebe8b4265717e91cd79b47bf00cac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56df728e1fba01b23dd2c556d48261d4d
SHA101d6c28d0e89e1f37cce380ef746b6348455b327
SHA25698c64b491d80aa171abc779e224f992738f613e73d972ee1be473145b1d7f54b
SHA51224bbec0313a639dbf00e2adf29e4ee949480b206eb96c205f53d59d1781cdc5072e33684d5b359a78163a91f1c505dcce4b9d66fe92c0f6c5568e69218726ec5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8de8ed85c608dcc7f0878a8758d454d
SHA1def53e4f32b1905d77fbee59b3fed2d5d2fb553c
SHA2566b46123c0f1069a1733bef069448986bb8bc04de92bfa2201aae962f89e0e8ef
SHA5120ee4077f8e7d9c93fb488f5767537f3aad2283f1266a051e570e1dad87100e27406c04bea8bf7eec696ddd29b4cd10a50d9b56af4e4869a99bb91241490cc71f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e3d41078850db60bc550c2521f92f46
SHA1254ce65dc455de1b0d7ab91e3f6e11793a3411ec
SHA256d96a1055f09736d733598ba0d9250a371b87f475f5a01627141353d7a819dff3
SHA512825f495804ff66d878d9eba61309291750ab20ff0bdcd34fcdec3f96c480d3eff69c55b220a5f845e3bbf42c3cbc7c50f312b5be38438160335879080cdb2c8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5759cefedd185f2faee467a197c51b2ca
SHA1081686bcec579aa08215d8e2082a6c3b0f71719f
SHA256739ecfbbd4abddacaf2afc1b56168201848dccc2c6b7f5e4851597a132877d22
SHA512f1525c72424614b12cc551c1e920fc91141e13aa146e04cd63a6bc1ca010c38ab0523e99c5a4d995eb9b615f85a114c89d5deedf347961751e2d0657d7be30e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55385934bf09c9ddcbbdabd6ed0b8161a
SHA13ea6928da9ddfeaaafea33e2611d1a150deef8d9
SHA25669364e320d39ebafa53172ff64c1d5a63814c947c2359c969424bcac969015f3
SHA51219c8add683282042c0b3c135ba68b9b1f270ecbcec776b23b24f015b52224d5acc430c6645749cd070f1a09e50d852771e5e17a8074559b12fed509b671d76e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504f0f937b7ee9d0e1e615f4ff4a00171
SHA13054d01edbfbc9b9eb75b8115a382ab7cbe8f8cd
SHA256bea71fc507d3ade3ab8b443bcad5527981d0f0a6dca16146aeafb056a79f68fe
SHA5127e668c69750bd42c9bbb99cb326af4fc81d73343d4e15da4b728732227337de59ba53837e7ca183a4505d603b31888fbb5ff365626ddc3b85553030e4e64d5cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55816c670253e99d6160f485769357af2
SHA151b4fd2b7012896f87457188b1db2dffd7864299
SHA256e9450632c635a927d399357b1a39a30bfed348bbbfed460f1c2774b088355c11
SHA5125f093580e051e93bfd80ce0b567b1f498ce44799f83aee1b00fd6439367cf8a9b53ec5baf6aa8f64411125eef151835582fd99abc6360478181e0ac4856f1725
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5180c1f725bfa0ef87106c9beaa1598fd
SHA197d475a354035f3df2473ee935b806ae6a204623
SHA256dd2b24accbb6f486d524b18d4bb4b9f965d1773b3269160380b34a315f2c3da5
SHA5125973f0ccb28706da02445e010fa2b7eacd7632cc80dc556c82c6c1644ccdebe22d35f26cba780bf80c71bf6d7ec32fe648c612fda54e77f72a35e0803c862600
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\px[1].js
Filesize346B
MD5f84f931c0dd37448e03f0dabf4e4ca9f
SHA19c2c50edcf576453ccc07bf65668bd23c76e8663
SHA2565c1d5fd46a88611c31ecbb8ffc1142a7e74ec7fb7d72bd3891131c880ef3f584
SHA512afc3089d932fb030e932bf6414ac05681771051dd51d164f09635ca09cbd8525a52879524b6aa24e972e7766ddf529484cc1ec416de8b61255435a89ba781f8c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGM5U0T3\sale_form[1].js
Filesize761B
MD564f809e06446647e192fce8d1ec34e09
SHA15b7ced07da42e205067afa88615317a277a4a82c
SHA256f52cbd664986ad7ed6e71c448e2d31d1a16463e4d9b7bca0c6be278649ccc4f3
SHA5125f61bbe241f6b8636a487e6601f08a48bffd62549291db83c1f05f90d26751841db43357d7fe500ffba1bc19a8ab63c6d4767ba901c7eded5d65a1b443b1dd78
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06