Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 14:27
Static task
static1
Behavioral task
behavioral1
Sample
39d14d2d369d4c6c4a968b379caeee71.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
39d14d2d369d4c6c4a968b379caeee71.html
Resource
win10v2004-20231215-en
General
-
Target
39d14d2d369d4c6c4a968b379caeee71.html
-
Size
22KB
-
MD5
39d14d2d369d4c6c4a968b379caeee71
-
SHA1
7e8c86195918897fe1ce1cc1299f07b1de5ca6da
-
SHA256
720c2cb2637f10a63f5fd9f8eb3ca48ef0221057ae9b00f3f8d996cf00123e5c
-
SHA512
4e966822399ea1ab3b102e14a6d50bccb6fe50f9c1741108bd3e6bd7fb66508816fa48cb10117cec4b9f48f0fcda03c7e31212dd4b1f081b481451b31e57412e
-
SSDEEP
384:Te5u+LXvbNv2GvILvLAvHrv2bv/fvnQvz4vHBvF1++VYPvvlCvMzvYIvABS+zAvS:Te5K0dkJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000b21ec86cf3b2291abfc83cf7bbd818bf01323318065e354af6b760424a00f0d3000000000e8000000002000020000000d02cfb9ffd06eb42c1ff6cc54edb074fbfc73999dab643500b22e3b9bc6a9a0d90000000f82ade01e90da30452dda781f5389489eba96dcd0f6824f0db4284b42210947ff5990ba80d5bd17b984bb78e9f6a9117e8ee6e9825989814bb63e44d9fc646eea18f6e626b4cc573f4331b3b063ce6444de30c2b4041c309d8793f9fad1897a37a97beda5192e7be33b01735d95131d4b98b4ac912d400f1c8d0cffd017567e147f7672214c7f733e587b7f47569749c40000000f42c32f54bb9d2c74e8d7411895fc7d3ba5b5499c0ebb63b1e7359067707181571116557d2cff95af84577631086e1f7bae88e2678a885db0adea0e2f7a6eb9c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37593C71-ABFE-11EE-8A74-66F723737CE2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8007c91e0b40da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410643759" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000911dd59b5d9b9c646647319000e13ea0b057bc3bbb71b6a86e02554848983b9a000000000e800000000200002000000022e544d3c41b333c61cbc24adbbf2ca208472b0f928310e9f30f3f6064e046162000000046c1d6108c77c8bab675a2a867144449aa9555a66a0148a34f002312f89d06cb40000000b50d72b894880c7ea3ab2122b185629f24127aaf5ba794eb86a59de40ace0e5fce490c01cbe17c26f88ce6258f2b8c1f803ca8cf70e313fd88ba1d69dce6299d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2372 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2372 iexplore.exe 2372 iexplore.exe 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE 2988 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2988 2372 iexplore.exe 28 PID 2372 wrote to memory of 2988 2372 iexplore.exe 28 PID 2372 wrote to memory of 2988 2372 iexplore.exe 28 PID 2372 wrote to memory of 2988 2372 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\39d14d2d369d4c6c4a968b379caeee71.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD54819c7b9433d094eaf671adb7396c656
SHA158befa9bb13608b0831dbcea643698797561603e
SHA256e298e1cbea9f2ab06cf22576e6bb04eb68a44faae92ce6a01355c2efb32eea50
SHA512cdf969d9e97fa2e316e253d3332a33f0ad5063def70e09e3cd8bd6beb04bbfc93141432f38041865593ca8b24311b5adefccf6778fc13eeb26ed839393398bbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4510c9d7df67563c05c2606c1e86015
SHA108a84ff0fa01633a2c6af166a27ef895c53c81ef
SHA256dce0c319764ebaaab6a9fdd75d60ea7c49f6fd607a056ecfe07cddb6da398f61
SHA5123c64964d071e00af32e621d5ae996539a4531a6d4699b679c0fb098d53b19ff25e0c551a6e3a32162d4cf1612aab36882b9b5ae3c1e2dc0da654d3ef76c7bd13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50af9f9090a5de9b808a2f5c2c2bb02b0
SHA11a4e6720caa28711e0d1b57d7f9b6396b2fc8087
SHA2567e04973b082b9a4030354cd75b5607ed1a15e6bb450bd68bdb44d60210919522
SHA512e52e682d0ec16026ff0c6a3f55f0849e550b71e583be1f675129d37448577aac8f9edbdb5f44422495ac1088c9d2aa250d806937749dba98e869d74d3526b0a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5639a3c1da33d277fe3f2778e6f3b172c
SHA1a62f3cc357f88bbc36877f5fe37008e84e2c6673
SHA2562e58b5571e1ad2ff79cb1781f989738e98ad8832062f5037ed2c5f9338ea09d0
SHA512497106bd6ad8852b741cf07320027ac1002601613ac3c4851770e9b16df5de87a8b2cc258a15abc863cd00a68b0414ca3ff2b78ad44f22ac9e99ecd18e03d807
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512d2fbafe511309ed251372073e7eac7
SHA173694171a5d89e8ddb1be09153fc9bea46a79578
SHA256f8be9973ba0503f71c7e580dcfadfbdd9d594df4f2d2d43adf638cacc5573de6
SHA51264a62476869db75c8da0bc7ac9be07c8918b7925a970a56cac39b7026cb3ab25574687ca6f8161b4d069fdf39a5a009ea4a89cb8fe99eb3789c3a3654416071b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59338033d5358db538306b2d1a4ef03b9
SHA12442a7f5bbf9f99d67e04b9df7ec2a6d8202e896
SHA2565ca6ce786fd6da7b70ab4a72ff3b2d2178433bfdf18d8b7a8ffe1b81254e2975
SHA5125b3a7ff6b27d9aab13bbec963654204f27b2e4bea4bbee7f044e81c021ec8e8cea47835141bd799bd2bbd9fc0010b713133d7dc78b7873ae3c843e1a4407e784
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b339a83da584fb0f23ecc41238d33d71
SHA1920bf786eb8df183919850bec5967b5982bf2e5d
SHA2561926594678e2febc64d04b5093456d00abc857be4d0be40ccac1bbdc28a30d53
SHA512269833c6d30411c70e23c10974f3b1ec51cc50c0fb8b7e622f3dec7dc73650d69fa78ba4d8e3380e158fd48aaa7cd34b60c36442756b04b1cfa03199c5c7baf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb711b38ef57d2d1a32e015e538dcf0c
SHA1f2eadfda1d41e067b20acfb822fb93b63e176209
SHA256f16a6980c31539cce4444f295287d3d7b99f29ddedf1bbded7e697a9a1ffdde8
SHA512af52c15fdba79ff4c480351600d1d2fa46db04353753d3374a71460ce09584e59494a7608d8169acc177a8313fec93869c733326e8172102646dddf3379492ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5635a5dea1412d68e565f4ffc18d86dd9
SHA145b3ba9f8a0a7a5a56bc6c31e45f3e1fc9054340
SHA2568a2126363df4ae56833edf04d2451fdb18d4f62b424ec9014688d0135a08e906
SHA512fe3d978905a8e810d55f400fa92f574eb2aec61c0fe4c710170a11e652adec8f64777b6f007e1a4557425343857df8bd2db7b2034cb0d01e30ec677926a2acff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee6e96a6fb927461bab22c6c2cc3fe1f
SHA191eba7a07d619405da1f2e6bc5778914b8835904
SHA2569e767f35fc108092998d3ae309e334eae3bc5d38553f80db4a62febbcdf40d07
SHA5121c5f5795a4f9b35bc6aa97f0582ea2f626f6480f0ef0bf6cca5312a610623dccab4ea8f53262fe053d04ce433cb82ef67d0030db9c65e211e91e41446cacb1c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55cc81eee2d8dbb69f7567d2c6140c343
SHA1949fb33c59c828575fafef6d9855714eeeea1d43
SHA25615b3fee22cf9e07dd5edaa1cc1ba786bfb9aa2ff1761aaea3e914982bdac3527
SHA51255c4b50efb2a1e0b795d89b00463a41cb7297b7e2970bd8b37a6e7560aad1d936c47c7dbb1417baccebcf4fa92f0ce41944d4b75b3d6e74eaa8aeb28771c4c5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f31d78e248c5336cef8f12e88cb92422
SHA16fa8cc36a6ed12617220a7ccbb9bac47994429db
SHA2567fc570165500ec9a5318c3ce97e8fad956c80faffd26eeedaaae6ae05a776e0d
SHA51279a9990f70db332b09d07312d78baac9b8807048457a4c90db50190888cc51a2a0c47611457cd88fc11db599d5939f626266ec22dc6a3c311c7b5e6b74b76495
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce7b245ad2239c1bd4e9224ea530263c
SHA121cf97664f5192f756947495573ec605baaaaf14
SHA256cf908ca6e4aaae4f5922bcbc5f18520c97c23414b18e95f46ee4074a136b9b68
SHA512bdfb5fe02026da09c63f416f2c9bb76ba0ce9195ff3d46158765b7cecfc98177d7c6e74b498b6682952fbff073338b60d3fbaca719771404dc6347d3e82cacab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD541afe4f073550b12ae1b030028b4ff56
SHA1ae3527d197dbc1b1314baf3ded55ae6753436d13
SHA2566f4bf4e593e0beaf69931a0373d602c946edfb5e60ee34b04fcb7f39bc1037b7
SHA512f99400f61b156bc7d7fb89b4b26b299d090361ed55331af9264eb711b26874355774a006498eefe4b84b13dbbc24597cfbebaea894421a9ba255bf62241f4ad0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06