Analysis
-
max time kernel
123s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04-01-2024 01:19
Static task
static1
Behavioral task
behavioral1
Sample
3f8916a7abd7ea92fad9cd011d5b7f0a.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3f8916a7abd7ea92fad9cd011d5b7f0a.html
Resource
win10v2004-20231215-en
General
-
Target
3f8916a7abd7ea92fad9cd011d5b7f0a.html
-
Size
3.5MB
-
MD5
3f8916a7abd7ea92fad9cd011d5b7f0a
-
SHA1
b5f5c647f9379f72f95665d03f7eeafda40c10e0
-
SHA256
96a059f01dbedb07c90d30569b84563e5b09529fa58d366dc920cfabbc39c3ca
-
SHA512
7cbb8060b774c9925e7224b800613f7f46ed84cedf8d7ae3b5e64a390d66cd13949fc133f14cfea7eef7573965a4ba172c2fe056c80d3882a840b0a0d6620fbf
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NNA:jvpjte4tT6DA
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000000e3a5ae1572e562e1caa5513372c55b060c6d5177fa45c9c862a9353dddb2a05000000000e8000000002000020000000d33ca6a8ce784950d21371e780e1b441f3df243db54bb31ed855af84bcb7321b200000007a7d93a18ec8e0c6a3d022af813fed55622757526bd961c3e5085c8a32f7040c40000000e7b1b7ba0bdd062354f71de45329b841a07e4a42958bbcab45dedc9c007ec7dca10584a3634b0839435fbe11c9fee6c434836aa398a753a33ef943abe2a73c84 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307a6858ac3eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{746CD6E1-AA9F-11EE-BF28-E6629DF8543F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000017685b257a7840376aa8fd9e9a40c866e340f6008e526a0961c75c88c39bc38c000000000e8000000002000020000000e7b0961a014772ebcc790c4d2b239648980ed6bb019f1aa5598cff8f95f75a86900000009c8fec827b7a1702f203accbfa5afa1d41dddb9d4025a49da5b4c7f248f6778a26e4415905768020095841d20807946b224b263267f994daa6f6316178ce1a6f1cb8ad6ff88f93091d2958024ab5a052ee18e68c61954467c4fa99c1be611bb3da0643486cb23ec772b6e40d21637fd5ead5c346cf75fe21edd4684b45fe039d5bb663ea2f5b4b190070cd9c371fa13940000000ab6054496b00055554ab992304ea010258ee70a6c747a4df4bba7d8efa8a531bb082ed75e3c45304a01104f34336c46c61834191c0fa682be3549e6180171764 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410493156" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2092 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2092 iexplore.exe 2092 iexplore.exe 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2644 2092 iexplore.exe 28 PID 2092 wrote to memory of 2644 2092 iexplore.exe 28 PID 2092 wrote to memory of 2644 2092 iexplore.exe 28 PID 2092 wrote to memory of 2644 2092 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f8916a7abd7ea92fad9cd011d5b7f0a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7a555b5db47ecc0ca476ec23c9b7d57
SHA1669f82a85b4948671d5f74e57bc179fe2b0f43cc
SHA25633b4ac163709bcc0642f92f6507242235fd75342f5e4862478dacd2585d44d03
SHA512c810542a06b89d4c5e6f4740bfc00d9eba202484cf3276dc5433072e790a35a9c6d2080562bbb796180811a59e522d577126f67fe470e3cf620bebb9a2630072
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500ea8403fdeeabb1e9271f709d364e29
SHA1345539d8361961fb1edb1f5dda7f1d507d2415e8
SHA256a26fa430c8d74f7dd997f11d75673fb12ee461aa7b67acb5b9800e475d3cfef7
SHA51284fd3fe59bf7926b7b3221ae977d2491b44fec1c109191d8892991844e71d8ac6ee6882470bde6b798861ff86cd3111c059861c8deb1e2cb28f654e7a0b72414
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f413fd2fbb0ffc63fb569d4a836f025
SHA174f0df3a6f75ffc20ff60dfc12ef49158309d83c
SHA256c735e161acfe742be238e6c646a7f3308fb405da801cc9d84ef4eef9cdfa75bf
SHA51291b6fdf442a5c258d917711c16c7e6a1ca1241dce19c3382bd0265066455aca75f91ab0d4d8717d6c32f56b6e881f35cf74965baa956b8206c6f66bfd9885193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5414a64cf6716cd16ddcfd44290807d
SHA14a8628fc89842f6df2edb108fd93d242dd66a37b
SHA256bc24ece331c71e538bdf1d23e1b841e83563112038bd6101f7eb58847a4278cc
SHA5124e3eb03d89f5f2519b69324ff4df20441fb8f8b4168639aac46654939588bb8aa26b6f3c1870bbf4d24a0d9d7816dc6108beb7449b0c2186bed700dbfaa5ac7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dad2fcdf8adeac8112467f130f855dc5
SHA13404855674a219fa9ca0c2012c831b576bf90853
SHA25604cdd72cdc37f8f28b8ec87c6b4b7fc41b1573b85a2b093825e17f4e99839143
SHA512bb017124e613a8edc1cb9483f4869c17478ae6b82653f38784a444169b264f54fb6a474dcad404343cfe49003b17ff9fb7a23a21235fa335f08279c52f991046
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd13167cd44e03aa7c99ad835219a90d
SHA12ce8c6d77e182efc05e32c49b3f5ab6d682d8b2e
SHA2567914a40bc8816169105dfa932712808d975fc191d113276c304bba7d65740b1a
SHA51255befa45c2e46a5d612c78fe8857a35c1ed51bf200e3d4e844b578ca5aff72b2f091f37f4ee45bef44071deef7f149a7c70e12d9f3d093c4f5cf176a63c6cdc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7ae1f1724a7c16f2cc348ec25bc60d6
SHA14f439e9433d4b74d8f85c94d2d6eb53606c5e8e8
SHA256271c35876df548a849c1824c93b5817f3a19d09f12996d26ed3d1034551cdc24
SHA512bc69988b2e253ec6bf87da73570adbd10dc44e55febe9b2878fb3c973ef69d314133abfed4b18ae245647f35f40011087ca107f76ed48b55cda2276750873b39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fe616841738cb066dfc8077b5333925
SHA10550b1e3c88e52ce079cfeeac1545f371abe6a03
SHA256911028dd8d68d2837f97181844fe65aa0265566d0783aace40b40fef0a0781c4
SHA512a09ee608123b69254a58b450f889eb2979991274fe27dcbf00086bd6de9ffeadb8432cd5b55c3b4512df3b64e351f80371991ef29c071592dcc32a8545d8e294
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b84d7bed103b7a5b597f716dcf02fb0
SHA180c7612dfeb15230d878a4b4f5427880210beb22
SHA2568425db4a0b6138198b8f92dc2081efab7dd3399b6226e54f59797a1bdbd2e337
SHA512b968596fcf45e89600e144632a454c573db35bb9928627922ad38f9b553164f02d10c8ad590f61546057bdd2d18a8cae83fde7020146f9d0e4b1aa29246621ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7cc0592878399428491971cdd9de0db
SHA1e57c6c91af95d18dc1dcf8fcd2fffc67ed4b1dec
SHA256a23cbb243c691a0db01dfd22083653870fd976a33169aec20a817ff016c43f0c
SHA512002f175929ed98336874f7a95f29bf20c9e728e5fdd6e8ae9f5249a536dd02c3c9ff9fb26506218ff2da64ef91efde02b1a68e3daa20b15b7c292ddf31ffc15c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a51a9ef87040bed45a0dfac91f740e62
SHA11d6827c1898fa0b81da6fd82810198b779d8fc8e
SHA256dcdf453815eb0f3c0092e7b8caba66798c67fff7233bc19065f4acff4b488123
SHA512d7af357372c5795e88f4cb5c4e44ad064fc62dd7b2c93f22e37f08c2eae63de7182ce10a47a0a91281feb27ac37f297c9fd1f94b3d84bdb085963aa44fc20a8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e548d0d03c27777f50f99529cea4d5fb
SHA170883f43cb85c9a165378edbf756e425f1ad091d
SHA256eb029c7edd893a126e462514e6ac1621940636ca5d3ceadf2f3c5bcfc5abe353
SHA5129897c9732d1382f00bf40f968f4633011d9915523fa2173da92b96d0f55a2a9f1c6684975142439c25869a0ce9fbcaa569418102b75828c6bb1a96ae878d95ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5732b2213df194973bd73b4350341567e
SHA19c98c1ba1a124bce1068a7da7d235237385ebaff
SHA256deca9c501e2c19ad6cd2a8902427fae0bb7a76090112d61f341b8c3edbf68926
SHA5125157de33b4fc68d9c6f7e1d3e875384cfe5cc6969ec1185fe4d55db6ed75bb2b76ba97eb134c9582a3cd205814a162b2d87f31cc3e8910d87b494f1222ef8457
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ca5c62af54af7b59c0c9cda8216d248
SHA112b25f3646618eaf698c134f6d4e1e85186a931d
SHA256c9637e097e9b247f95536541a7ffba99e1e3dff46a1bf767289a5797812d6642
SHA512608c3f24a0c4d46f82609ce8d27ff657b8605036210af70bab2f4794d6931f449c3d87f6b1b8ca975691f1f4956418a6a03a9f348c9caab7f89da0fb734f0c6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2daeaa16653eaced15a898b51a9f215
SHA1136c155523c2a4101d79b29a9090d79777c2b708
SHA256d767166f4c3860d69e2cb09a7b37aa7eef7ff256f10f56e5efa2fcee97e6c550
SHA51229676bea1c519783b321a9182bb33bacee42604a12e19c6c141a0c80493c6e60306a45a82359cccd7355c8c658a71eb43dbb2dc8f191aa7ceecfcb5479640e29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c115d481b5a60106cb79190e4dcb8419
SHA1b42f52ef88d2f75c49210221ede706ed41cace05
SHA256522eb8fbd651f995a81bc382c0996819e4c208d0ad42f61e6135c7de226ff5de
SHA5128d5251c7149731d8231a11e05db7dc5d733095124190cef25aca98c33d2f19fbbeab5d2fc43ee16dcd72ee80b09716a5e690b1c4b7f2e55a8868e03fb2ff5689
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdb2990e882fa7698b919fa15784161e
SHA1451d03b15b28b2705a11ae7f5fda7b74748ebe06
SHA256b5b7e8ffb955235dd5d77379dec10fd219e0afe001b1d7533b49c76650b2db96
SHA5127ae7bbe54ecb1209c773e6ef369595b70f203edc153bae8be04c60069028a149097fd046ee9adfee492c295d76898ab6b7d9233ffb0d456b38814b4caae162dd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06