Analysis
-
max time kernel
142s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02/01/2024, 17:49
Static task
static1
Behavioral task
behavioral1
Sample
3e9e2bc7513f1b1ce66c83a30ad6397e.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3e9e2bc7513f1b1ce66c83a30ad6397e.html
Resource
win10v2004-20231215-en
General
-
Target
3e9e2bc7513f1b1ce66c83a30ad6397e.html
-
Size
3KB
-
MD5
3e9e2bc7513f1b1ce66c83a30ad6397e
-
SHA1
2f9f364bca3392d71d7a0a5fa1b3b22ab3f3104e
-
SHA256
9da7b97dee43e98adfbb9c7da7803b2f36fc2334becbcbc932fc8a1dc1ec4bf7
-
SHA512
869bd3a370b7e7d1e7f8a8cd65605f87b98fa8b1b5805b31cbc00083eaf3b779f1f18babc404d354750b3529c5c0ac9eb3ffe806f659f550cab723f7de5363c6
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9022177da43dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\phpnet.us IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "32" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A85A631-A997-11EE-966D-76D8C56D161B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000d7b1b4182f577df12ab60caa300df038d1c327e27cda96557ed2fb6ad2363ee9000000000e8000000002000020000000427f77c572fe63b7ff81978ac4b7499164163cfd2082033f760d7b7145d94df29000000033967b53d0f281b13b959a5f6c2d6ce95ca6aa257e88bed14ce14effc7ffbead6302888175b5851af8b64fce1c20a023ec881103b31d9047f62b641a03ef4acefaf4aa94e586180fe9f182ba772e7b4f7085fdbf459bb65053e2cbfc36a977d6a9900ee2dfa9b52bb773164ef584f608bf7fde5b06dc22b2d436287cef5830a60b6e0224a2ed857976d083888188616640000000c006dc4bd73b9d56b2f6e9a181517d1146cd5b6851ee8e13e34b07989ac3fb489b58b678410521e72761547124d20c62ad00349f3bdb9c6b69011856a6405433 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\phpnet.us\ = "32" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\phpnet.us\Total = "32" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000479d7ff12d8eef3275961e6fa2d8344775d8802dd0f73f73abddb29cbb7e6ef0000000000e800000000200002000000086698367e728da2502b1b9fb0699b155b95a68ae3f5d6be7c57c0f0438d1e2bd200000001437550d472f0155e23825af1169f1fce67de324a995f8a07c1e0aeb3a8fc70a4000000009ac34865db994c2b5ee8c5bad5a51035144b805f6ca6ee233587e049f1c05049d039631ae21c4895c1dfd34ca94d2577dd1bba3c4cf673537c4f76276a70cb5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\phpnet.us\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410379789" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2004 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2004 iexplore.exe 2004 iexplore.exe 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2312 2004 iexplore.exe 28 PID 2004 wrote to memory of 2312 2004 iexplore.exe 28 PID 2004 wrote to memory of 2312 2004 iexplore.exe 28 PID 2004 wrote to memory of 2312 2004 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e9e2bc7513f1b1ce66c83a30ad6397e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5ddd8c88d8d31414f1c50f6f4924f52
SHA14b025bd7eaa42bfc3b0636703b248e38c9735828
SHA256d71dc484faa655499d85b5a4468ef82c7cb85825287087a4a15dbd40d08839fe
SHA512ac7a5ced77ed0e44fb140269b2b4e1666f8c49105c91f9ea9b31c4584921db2f745b450f5bb36601452d6ff3b1fab888bf3d1ced2ced81688786b4c2fe31bf6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b967538b73335c752bbd233e050563ca
SHA11ba4cdd1de0612036e4fdd2de271db9ab317c5af
SHA2561f0eac179565b153f43b0f0d018babbdd71ebb6c91fe184ff6fb1e31d628b8e0
SHA512631fc9f52894a5082243f8f8f844a152632fc971d0484dbbee0b12535e740da579b07f221c85c71cddf24f066ce679308bbe3261d0b2c076464c856c7181390a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5048c934e2830e122406dea5276c05798
SHA15befa12491f67893e9aab6a83a638e0643331ae7
SHA256239e5f06faf7e08a3a0b5ddae0141f2dede727f2106f5c615f1143fd153a7b7c
SHA5121296bcb928734e1090ca03fc0fd79e8c65decc43407306fad752f165cb553cc30676a07dcdc0ff40bd35e1f84e9319512f4af1b0ebe61d12d7d36f35eb0bb203
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5134cc541809868a64421d37d8800de80
SHA1ba2c7df058e45dc690551b70fb71bb4dfbd317e7
SHA25604d35786e9a85939197ea0420369b7d1db7be1d245143c53443e822053de1034
SHA5128c2a804c8d69ae42c5d3b7dede0fc8d5aa6bc87a3fdf72dc4633f60813b6a1fdfe3280bbce5612701c217715a35844a84b2de289224ef24a194b3dad76f12b5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5259668acc6a28c1431b1664e54382d46
SHA1248bb1c5d317a60b2e4d953abe9329bae826d346
SHA256cc95abaaa09aceea682f08409e675f6c967dfa7a71cfa0842d2ecd6797de23c5
SHA512a388d5d49bf2050293eb06f62daac0d877687cf82a73c25161c7166b42d6fb8a308b070b5a228bd7474dae9d403f6c6026435166ecbb750ce7c0713815532f8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573dd6f0212ddb7b3d0106d9d6e538805
SHA12f4b8699c868c7334f6390bdfbd49634d759fbe1
SHA256142d3c9fdafa1e60f25c6d4bf9e6452d2f244080bf9a516f46cc63e727c78dd4
SHA5128be00e18d29524866f55ba13cda04003d2b34c587ee8b930fca64a9cc02988900fbfe2b33a2d80070031d627e7a757cfe4634e55c802b3a10b73aa38f2f89fb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bc0a4883914daf2ccc5529569a58dbb
SHA1afe9af9ce6e129713533c19f5f5a009234b2369a
SHA2564ff79fbe0efca8fce31ae37929e58c7b80e3f79feab6d6915b5e9d53a3531d3d
SHA512baeb4e02b170317f56e32f661d8435f2592e29ce9a91639b057577c46182c6bafb06010ff4f7d080778c967d77d428346d3e021934ddf24b949eca964ba04a08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1cf941eb26f0cb21ddbd587c54b8be1
SHA1bf228711b8f446961af096e860da717d7084ead5
SHA256c8fceb6b7491154a742df033827b26b1518a2857276863d286f57a09a88d52fb
SHA512e167a9b0912f1be2ad68ddadb12448581901c3b8c752eb1d79214e4956ea963064080adc17d05aecdc7c4c4fdd9975dd361a08ec76dfb432555834e09a86446f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b97159db0c063e2bbe7eb97a82aa129
SHA138267b14c6751f49660545c0f0196605b56fe416
SHA256529ad8c911da9b25cdeedee86f4e67a915275e4c7d2a98d6ea8338edd2b6cf43
SHA512e8e7fcc1d01bb5c870737f8dd5c046c4d5782ccf10db7cccc2cb0ea6cbf6c4d687e3a937e37d3dada8fc2aa6bb2931cbd21f62cf654ac4798d9145176425e784
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3d84624bda7f6b4f5c57d686d2839ee
SHA179823e1088fbffd62ea308c0a6708276a0e06829
SHA2560ac9040e8791a133810657b782033b22f13c9771391da98a34e5a7b1daa7928c
SHA512780ce6c03a004a708965c58b30c66f92b66846c01fc9ac0416b2b0b2d3bceee6968f8f7d0a7c32159fdb04db6d280cbb80cb2317859bde14751ab1026c7e6657
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06