Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
372ca4e601bb4e0945823a5256807ba0.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
372ca4e601bb4e0945823a5256807ba0.html
Resource
win10v2004-20231215-en
General
-
Target
372ca4e601bb4e0945823a5256807ba0.html
-
Size
3.5MB
-
MD5
372ca4e601bb4e0945823a5256807ba0
-
SHA1
25b830628fe2b323ae4d519a604bf50441b8eed9
-
SHA256
11c7784eb8b285dc4c166641a52b82ad48c5279fb607ae69d8c9e30597e80243
-
SHA512
bdc212bada1d1d50d98acdb364a82d33c21ce884fd60428d999c7bb1cc1aaf3f8280cb403494e42ae1840aef3543c747781c6d4951abc378c0e7749e05d955b5
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nu2:jvpjte4tT6s2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0255dae4e3fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0FCEA61-AB41-11EE-9911-62ABD1C114F0} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000008d1898fdbde241184dd5762bac0c1533002a8f8ed8fa02df7acf2e08053178e7000000000e800000000200002000000013a75b0f260fee5df31f0f1b2279b199d8c5a0c212ea44ad76558763c89c7ca2900000001a5e28e51dbfbf09eae029003474aaa4611d165c5dfd8774a87638c3bfdb99f8175fe7d69a0681b4e34837b74b2e5af7755a7dbf91c0687ac95937a39ba3402f484e2a310fecbcff1f6f8351c5e4d4eaa8de15e8dba51892203c2c3f7c9cddb524c00339b7e819675bc4332e851c3551144583d64c563006bf3e78819f5661e101944686295eebceee7e99884f49eaed400000003f5f2b5d14ba7d6f958dcde0e32c80610c5b3f9af0af3d8bc9655fd466a8243fe24437e6f296bc864b0257c21eb112cd215c63b7207cfdf0e1bf3aa2ffaa312a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410562856" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000006d5648d88af51ea0ac19624b44ac2f1bb501e27e07d7769907d207cd1cc208fe000000000e800000000200002000000044337f7efb83241d7384a4704a7f53670667fe93cd80ee5fc30680a1d078e6c120000000ccae868f929591f2317eb6399c4f8a41b0721c69f10d4b7f7e1ec15d5f8d3dcf40000000c59f6fa922f1b7f82d8ecb9fcd3f94150f6d77e26137a9e0a9257c5510dc61309579d91d14a72d1fdbfd7015fc308c16bad3d2819062293c77479f7847b9f098 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2548 iexplore.exe 2548 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2092 2548 iexplore.exe 28 PID 2548 wrote to memory of 2092 2548 iexplore.exe 28 PID 2548 wrote to memory of 2092 2548 iexplore.exe 28 PID 2548 wrote to memory of 2092 2548 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\372ca4e601bb4e0945823a5256807ba0.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5a810ed4b7a4798fcadde23feb5d4a308
SHA1cba49af3974388649cbf41258c9138769534e76d
SHA2561a19f5422b73e68ad71262b91c5e3ea62ece2ad6e13074be088ca1a9e2b3223e
SHA5122ccc2f0e4fc07818c335dccab14c8bb700e420ac1197733da12653695dd469238379b5545172b15e2db5aa16d57c9b88c9f36ff891630e96b04a1d234409687b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f5b0769caf43021630b017771effe69
SHA1e3ef73b57d2bc769f4b7be935bd96a308e82ba92
SHA256d268b664f0e0401e6ef311580656867641b4cc8056178c93a56f2d1300696f9e
SHA5126fd21bcb3226d04bcbd8701d9e645299a2db7f681955d79fdaa08b94c861b53b807514154f3d95f5e910265ad4c5bb3fd81048b1f844e58289f9eb357f7d7e7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571dda1d06be94cdbdb2ee54e7c8f7e91
SHA13ec6f73e7037996804b75e5b540e40988d77b834
SHA256d857e88d0c10b22bb8e78f2d1783bf3053b914c53afaeee7fe0f1f5e4c7d0c97
SHA512b40bfd37b75b868a326dae7e6791b94cf57890bcf091cf3dd7a7f6cc3ad3d178b94a015cda363caa3fcbb207bd05aa496dce09a5d534903faebe0c3476807d19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf8bb60b37edf4470b2353e3d27e1445
SHA1992056a6553b7f52661d955b1a2c8ba6e2faad35
SHA256b79a06e67538e3c80d88c2822a366f05c2ce9a75af6db55c7545cffdf65ed54e
SHA51202c450d2f8aab5bdbe69a3a6a253eb3999b54317f020e2265a053ecbc463e5a48431b0367f51eee6af2817c1f51f8f047159a9610800265e8f23988ebb315272
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53709536643a1a2eb14c68b6e218b0684
SHA1c256b398fe41353bcdee8dc5e39022d2e43b9a20
SHA256b60b568fbf86958412c8ba95d1ec03bd93fd3c80362cf6dbd9b20a0e78a4e556
SHA5120a1e6d31c34c1b24c1746870a935aa19b9e86580c8fd529786fec78d6dc560417deba71267c0fd3ff5b941fd843abbe091c2e47fa1a72b1dde0864a8f5366ea5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bc593c5adc73edb2f1fd191214e086c
SHA11cc19c624a5c62c0d4ad4d3189d271c4affd8349
SHA25652b5dfbdb7f5fe745d210f895cca596d453e636ea747003efe1dee09e902353b
SHA512d6d5b26f96beb437ae6c908c8c696d3be959d01b032979633ef77dfe49b3f406b0840b096ccfa28c68c88ef3d2fcbf781166c59da6d342b132d5f9c9ee003a14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51dbb78d2bca95388d35ef3bbe27000d9
SHA102b38d66a8b31c2b568eb7a9d688fc11020819a1
SHA2565eea6808fc9e137b6ab6bb812cf00c75d3ff0d0634afd22d5606c10c37c31973
SHA51286d27f906e442364a166971dcfad03ef1be86d793d22e3a366c00034f66f49da8ed8bf597b10a882019d53d4fe59381eb2bd8b32033233ca647ed9665d8be3a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cd19d3ee444c4ac3c03569279fb074e
SHA1fa359db54ba51dbef93e62075658b9d5797a4da7
SHA256ca219d39abb5c44257a1d18907831f71faed241ceb95293804dd5ab329a01482
SHA5121b7dbb6dc5289f8208b255839a466378d692c476a74683daf8dbeb351521c5aa8399116fee17195fb1068069abcfc2be2f31d31f7c42c429597d88e428a41989
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3bc6f07798bf56c3b62bc6142b9cdd5
SHA18447a77aa632d211975022bee536ed2bd06b0e91
SHA256fcac03951c5811ad4179945b17eec13d5dbe7363bcefe0a17aefb08a36f6eebe
SHA51258b6051bd844daa5c3f8a145695df1fddb7ca244e6745cff0c0cf08e9dd0bfdb071d5dcb7bb88b90ff1c5447172c96098e7cb1faaf4db04cca8033deab92ca24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590c5fd254c9d571bb37fe3d584980893
SHA1fe99f8f61d682941e0f383e1eb9ed65630f83ae7
SHA25600d010500173f348e2a49937876186fc7b53c9b9de2936e47e4eebfa4319d5cc
SHA512a712d65c986a95b40e700ef003ccef603c0b1dc2e160e7bd3f3098013c49da50e7f20feaab1d07f97c11fc21d0ae3a57bbc784fc06a0037003718a33ea6060f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD56786c57f926f2f7c0f93df71fd7fc252
SHA14bb10c22bffd21e2e6f300a19306a340aad0456d
SHA2566dc15db45c02d4e626d90092b10c3918bce7883d7dc20c0dccd9e4c63b2de5f8
SHA512e968a2711926452e72cf3da89aedd38c3bfb9c4b9f865a0bc33bbf122cbb0873bd7c1a27df8e9529a0f4603137da089cc72341fa819a670d123d9ded671b8fa4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD536346c38736167b64e84bdbcc9a4cd49
SHA16171a5dcfd0b717ac19c376eec2807e4b5a2b5b0
SHA2568bb2a0c8bf1d3dca61a1544ded7a29a3f7d837f71da17713a745b73444e10e84
SHA512b21b20499c0484c335df83107446c7e589c25aa4ebc33e30e1cddd9cea1f804330b8204971365dbea2fccd018d3cfdf3efa69db26a95b8f7ba8302f5771f1250
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6ZH9KZWY\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KFU8KM96\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TT4P2PIW\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06