Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
38644867ffe7f8893c1d8a2966d0c3c1.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
38644867ffe7f8893c1d8a2966d0c3c1.html
Resource
win10v2004-20231215-en
General
-
Target
38644867ffe7f8893c1d8a2966d0c3c1.html
-
Size
436KB
-
MD5
38644867ffe7f8893c1d8a2966d0c3c1
-
SHA1
321c387972d46bbaacf93be414c67d9bbffaac4e
-
SHA256
b2c54478559a595da178c8d5b5292ca74b3cad1206d4cce509a68d8755fb994c
-
SHA512
c26c1c87fe59c0e6a64e3b2b80db070d69c83ed7e9bd3bff9ed6f246e826cf28ae33632d177d192e8572155a9e7d154729439aad9bda42ed189a0a63e0feca4b
-
SSDEEP
3072:ylQckjr7fRQWvhwhz5EeXyHyPaqBaCFneasBGtwDhPvNWcbhU94QfGqyhv:yMjRsy/YKvIh4QfGq4v
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000005c754d35b7a9b55bdb367cb367b369a7d40603fd9867999620a703a77cb46f2000000000e8000000002000020000000e127be306f167ab280b3fa6d25ba441177df5133c8ad202fdffe22bf88fa2f9d20000000969d746f3ebd0dc27c59f9f457ce4172c4be090347ca90e506978e24c187c84e40000000aeee0c909b1d5488409b368042c72ca8ddb3346a31fed45a4e6199b64a1e3a15f4d4d0a5a00e9e7984a8962bc8eb001e4d95a6d4e60ed3a5071be659dd76925d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000003f445ae7d0bde374d835cc7f3c11bf5a68ffbd7850e642a36c5ddb0409871f0000000000e8000000002000020000000d7d301db52b3a2396c6bd4b2578e5114b11b2cdffa77639557fd0ae89db73c3a90000000bb23f8f79329b0d9c490817b3b2cfd41f871922b062dda21ed30e32e46ad784b567752eaa2e5724554e9200fbb842c196c39e226762aecf8dc01a51953fe0c60766688f5330ab3f1d677af6747dd34acb2abc1ebf07e7e84336e67a54116e59e5e2e99385a74c99319dd27b33b0f5c2005a9d4fe29958ef1632dfb8c2e175176d1424c06723c9834984fb802abaef750400000005d7fcf8d9f9f77910f5e443c5a015a4afa70b1d0173b658b35cea2aad4361dfbe7b66e4524855a81799711e1289eab66ce8ed3ef86dac5c52018a568656acb5a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411073687" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3166A9F1-AFE7-11EE-9673-F6BE0C79E4FA} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d03f892af443da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2872 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2872 iexplore.exe 2872 iexplore.exe 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE 1984 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2872 wrote to memory of 1984 2872 iexplore.exe 28 PID 2872 wrote to memory of 1984 2872 iexplore.exe 28 PID 2872 wrote to memory of 1984 2872 iexplore.exe 28 PID 2872 wrote to memory of 1984 2872 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38644867ffe7f8893c1d8a2966d0c3c1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD5b2d3520d0a69242a254e30704118568a
SHA1c71a19e3469cc6b6011dc59922112de9e75094a1
SHA2568e174b4d189b20e46a44a8c260c66e0e1b9425d24f49737dcd7df6cd83c0ef69
SHA5127bd104b0be3f1ecfb2de0aa45cd0a182da9e8fe7e253b1d7559260ffabf48511a24aabbfd30e33dd1f7e37494525d785d997b84db38bc3a45477238abde6011a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e7331c2dc382147e1ab0fd77c9a7e0b
SHA100fc62648d42320a65e12ae0e30c8618ea59d091
SHA2565463f2cd9356c8d30c2c20ebf309c592958bff7411c0c0d9a478ae128d76c664
SHA5123cfcf47658fbd14c9d197f5db15c36d0d0f02163b6c26f41a49e17b2cc692ba13614394c2ec3d71b14ece85ba46af8e12a4d8a6bdd3e695787c3aa62a23b768d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dace19fd14ad746d1b65ca9cbea2b3d
SHA1f2a838bdcd6bb4e6e4e72c6789770356bdb1c641
SHA2567ac8f944995b26ce57a4e02c578cb0def246720be74331af19611cfe64209497
SHA512064d060ffb49dded1e4f118822b4f92a11e7c499c80b82372316d4d828eee61ddb6571fbc28ea8c6db2e760cb56b5ffa3f2ca5fb7fb886af58ef2379f97ee967
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dec3018b247fce18bcbca679cb22ab53
SHA1a79c07dad861c0ddb1d732cb6ca21e3778eb39d3
SHA2560858c337c1542fbadab1d85496f65b9e38d60dc477bcf173a6205817d7a10a02
SHA5125e467870c8bfcb6a4a5df86aaa86d896fe7aa622cda8ecdea0d2df682a21efcd6d9eb1bb60afc69be1c09d8c70b53d62ba357b6f1c0cbfb0b7fa01c99f6d13ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f5b3b6c2a9be323592b60040c48cb78
SHA1cd3b8eb77df32c884bad6204d30f642a3164cfe9
SHA25679b8f00aa77ae3e3a33be0cd1e9ba8ac0c2bf05479232544aca1e8caa804ea2e
SHA51212bf6d3f375c72638d08c4af22fb162a997758ab348488c2cff7a4614d3808abfe97fdf0bc3ff5d64c5594ab64e50f36a508e43f0fc07fd6f4f06dc3157e2e86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e204738821f4040ea4962bca2a474e6
SHA131fc7f5222b8911c409afab5791851a3bd71da75
SHA25610a5c5f501694e854044cfa588374efe3ea823a62b8dcce4a2f796a6b3547716
SHA512cbcc627f7fb82dc98cf72f7d1533e1c4408c3b44f490b261295964d671cd80459213ba6122949831550827a03898845604f278e932fd106213016bc233c516fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f55ef110cfc0ba8976be4fb6d156de65
SHA1d881c6570460070e66188f802fdfe1c25af0cf4f
SHA2565ce62163afae7ffdf2875fca7e8967ea8cc5bb5298ea188ff5f6b584c4c6e0af
SHA51247d3ee18a6ecbd7518d73e75410d68d66552470fbb056812495a4bb80828b8169abd13a6ab744599059b169494e07d7aa3e84b245c718bd8bbf0a87f98b2f626
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3c060bb1fd2636b840c91e8fc7d9f03
SHA1a463b8f173dd8393ec268c49cc4d1ab4fcc4e11d
SHA256a68bd5d149b728b25d2a18e1125e0b8d00957f304690e74c45022d4dadcb8442
SHA512a481f4f7596878d529f0d5f40f5861eefe8777c9b0f55e1755a197c9ab26c9a477ee5646b934f2226ba52a920e2d22fa46403a89d227dfed3f3045167ba1cdaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b27fd0fa32cdb36a7464f0dfc087c4da
SHA1e8aad1d360405efc081f9ca5d1b98e1c8e71cc94
SHA256d0d688926826ee35d8842ebbe009710738441e745decdaf04007dea6b707a731
SHA512413ceb1100bf3a9be820769facbbcfa0f7c20af83ef15a3b5fb11499552e19a246257efdf994c78d62f2c91043a5c54cecc4f205136b133b125cabee5d0581fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a192f9b02c04dd2e494fc7695856706
SHA15415ee0fd1b7cb613404b2c42ad2bf8c7297df83
SHA256203db897887bc1cd5c88d229e446f72e06d3e6ca79c8cd5e95efd3b2fd33209c
SHA51256950b52028e653c0f172f48e4d6a257d2f69714f5dfd0ee499a9eae461dae7695b2b4b087b89f547290c4e884e2f40af415744dbbbc2d6dda2e7a1fdea44469
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fea02c5bad657b6f1367387f40152475
SHA17542ba17ccebb5909da56bc2046902223886909a
SHA2568da8677efe5d3dadb4c800045e5d21be4c1c46a2f4e49df6b658bf29729ff324
SHA51256fa6b3982e517bf1800d4e5c5c017917b1dcc3a5b61e3df0998c7583a66f9f40d97f4376ca08badc53e3ef800d9051b3cfe2ae5806b435eb4c2b4a0d4d0c4cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5746fce43d8bd3a3c53793ba6ff6b1671
SHA1bf976cbe38bbf1cc7cff90833b76f4eb7ce9f54b
SHA256a44e53c7156e5b0c03454150057c8b639c76af9fb669f826c4f3cd474b826339
SHA512fc846816c6f1bec0231d3b1dfc412653ab1fbe195c122bfddae0784c8b8f131ce045cc11dbf6654f0a92ff01f8a89b24890082d91a747f7e309e0ecae2d18b60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522d45effab4198d80e29055ce317ee2a
SHA155f2ffcfde8aafa8ff7ca453a74ede37b9481b28
SHA256161a8a52d60a6aaf90aa8f0699936e350f3ffc74396e8dc003ddb78f06b9655c
SHA51270479753987138d333accea148106bf7b9074e3e3dde69606e07cd304cd93669f19585a574ba14349b9b6179871263434ed330de0ceb1e845287c6f7e504eb9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2c94d361619f9f16fac73725d0b6220
SHA19f79fda543f52d0be2a6997d837baa176af46cda
SHA256a2de522bb5d682f816ac211f752d9539e9cf83e171edf9ae60dcc2471b29ea44
SHA5123674f6f7084e254088efd18944ac9bce5cec623fb2d4dd9f4b7b1afbd272a2887658092e05c4c76576f25ee0c085acb169015335c39e88f05989fbe0147be191
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5266d2090ac14308fdd62d5834c7a95dd
SHA1adb5417feeced5578a482ddee2acbd6dbeca6d9c
SHA256f08a3d8128ae9ebee260f350bd80cb0084bbd7c1c2774f8e2470a211c0cd43f9
SHA51269dcb7fb70ea01c4ce9ac91a6a98175e9e314844a197c8cffdbf01e1330628f046bb0007c2477e23a7f7abff2392d6e66a68616645f98cb4ba2770acbe058101
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\jquery-3.3.1[1].js
Filesize265KB
MD56a07da9fae934baf3f749e876bbfdd96
SHA146a436eba01c79acdb225757ed80bf54bad6416b
SHA256d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad
SHA512e525248b09a6fb4022244682892e67bbf64a3e875eb889db43b0a24ab4a75077b5d5d26943ca382750d4febc3883193f3be581a4660065b6fc7b5ec20c4a044b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06