Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04-01-2024 02:37
Static task
static1
Behavioral task
behavioral1
Sample
3fae0382954b072fee42afaf85ad63c2.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3fae0382954b072fee42afaf85ad63c2.html
Resource
win10v2004-20231215-en
General
-
Target
3fae0382954b072fee42afaf85ad63c2.html
-
Size
16KB
-
MD5
3fae0382954b072fee42afaf85ad63c2
-
SHA1
7c6581d4a0ffbd653e29240ccc6802a59676c986
-
SHA256
dc5499d7fec34b7e0ef4ebe43b4a46cca2aafaded4ab9c97156e7389e2a25fe5
-
SHA512
ff016e0549fe818148aa6cdb31b754ac0edebce63c8d797e2069b6782609b7d9b9e74ce7f08ab1517cc88a76c81b2b91aaff649b2f8a285d8c4b4f517026356e
-
SSDEEP
384:G8w5V83xeiUec61+9xwMD4NyQsCg70GJu:GR8AiUu1+9xwMD4NyQLNr
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906bc32db73eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000277737e0af0ba5f8fe0a7d3d7632b6368a79b72930347951a52363d18cad4150000000000e8000000002000020000000a4df314b19aa660798a265319467cf2851b152e0da5e2b11ba2af15cd56574d79000000033c9eea34847354a03773e041fe7b53935b5468f1d3ff5001475f8829411e253365d03a9c4c0e9fcc5bd76508ec7a8e12aebba50240b6a44de0cc75c105e5ee77900016134fa7e24c4e62e3b5445943923e584bce38ebbf4c7afbe6f0695dd553e2f6b16139ed41c53f70e57e551b247321cfe8625e5f2950e8b88de6ffb2b37b005e0b93a35193678b0858bc3690dda400000007a737e904c294b2f88d26304b01596ccc2957bb4fffb609f02a5f64b591c9b29eff1a5af93221d3ae48f70eafcb1eda33939e2ed82f87457c04f19c729a73188 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57FE2DF1-AAAA-11EE-8452-CE9B5D0C5DE4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410497784" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000a17f9a287321bc5679b366b738959db4ed8998e8a3419658b38f91166f46657c000000000e80000000020000200000004b21a60875b73094ba21fd4144c1407f562360b73132257b6df437c76a3cac61200000007deaa22184173175320650286d7f0e0e46afd80cb291687b21e1c677dc951c8f40000000ba654ca573ceafe9eb558fe61273fd6b79dd7f9b01fa40a217911748b2aaee78a6b69208799326b5d0bae194e726d2be6bd7dfb1a441f93115ef033911046eea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1516 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1516 iexplore.exe 1516 iexplore.exe 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1516 wrote to memory of 2688 1516 iexplore.exe 17 PID 1516 wrote to memory of 2688 1516 iexplore.exe 17 PID 1516 wrote to memory of 2688 1516 iexplore.exe 17 PID 1516 wrote to memory of 2688 1516 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3fae0382954b072fee42afaf85ad63c2.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1516 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fe53c43046e008bd66ec22dd8410167
SHA1e02f0e695eef879dc2d9d0c6d525af3f866f111e
SHA2569a22593d8647b159777dcfacd54414e32252a4ce7650c153cd3fc49b2ec7db04
SHA512fae19bfe5411091929fa6e9a2dfc358053e290f8b97d1b950fe687752dd1340d858a23ce2de33094fdeb9c1c77065076ff0a858899d16a411fb0a5d8d7c7623b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54537f68482671f0501aacd2e3dde3a55
SHA14a49ddd83d28fe2994ba50e67377ac1b648194fb
SHA2564d5e4f14c0c7c18b9248ced20e73896556d06c586c8d30ca376be5a805258104
SHA51297636c609ec9bf61b1ad61035fb6e6dd20b9da8171a63e7014b68bdd85f15468487cf48f335e7a19e261ec0d67aa24267eb40d398832f5f12e8d9a7bce055241
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53aab02f7708f5342db8c4dc76aed272c
SHA115b93787a222158fc9f5ff0999e17347bc64948b
SHA256ebbacb474f2809998f7192179723544f318d8684ed0def226d87366b4f565a37
SHA512e134d3c86bab12246f9965ad3cad14adeb84739a9b213ba463beb277bdc645ac9e6e4b689bb2ac578127eff7945c1265bb454f6adf3fa4da6a8cdcb10a06af03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5727ee251deeb615a78ca5600ce37431b
SHA134cc51012d7b80e5af2a9ac35aa0f8be985424fa
SHA2569f0b87874de53e7ceebf4109ec5a9ee9f822b71b2d7efcac12744625117615ab
SHA51270d3e1ea3fe88c1dc5dff9aeb3a3786f13ea4ee257a6c040bc48eb034356e901dafabb1099f979ac53cae614b76789649ee5bd92bc107de3d6f55bc68b9c42f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d660d7af96aed7b1eee29e0a3ac1d0b5
SHA1dc4c46aa56b2cdbf79b0a4e7bd6c6a490ec2c719
SHA2565f3d5dfd54db0c90f2f8e8313b60de927a4f1b18d1b7c4a1c446bac93cc9c741
SHA512fbf72c2f56e05f6c20d2de067075651488ee7ef97443b80414c75ca81bb686110c098ed8d667b94117ac23b87b9d776dad08f16f05c0398eef985081c1141718
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b246dc0111adca5a23d5cc7c5d4f9d24
SHA1a79ac3523404b7b4960b599e3b91eb13bfb36585
SHA256c78e2b022c446ce9e2330d15188a6626d80397a6c64c2443e614777f9776eb1d
SHA512398d95dc5f7cb41cb6cf513305c0968ba94ee9f4196ef302e11292cc3bbc43bbc93e79e4ff9bb3ae78c2764dbd8b26c3c069db03f33ade908c18d62e163214bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53035cf6c6995f42c69ccf75d430852c0
SHA1274a48f2b3f295a23a6caf0ab54a2b91d63cfd4d
SHA2569c9a0fb5e2bcf81afae8b2e248efdc0915760bf1955e0cdd1acd7ab9f4d7e28c
SHA512fae6872773dce72320be0d9837080342985bbed6790187bb2aa3906b8fbe0a1d1488b5ecb5d863daa78195f115f41ab67c3cb76a04cdf01eff8978a8d6eb9e7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5556099de6d00ab5e2d585129931e4117
SHA12bd4dfdd6cb3c7de11a5b599d42cf65254e5c100
SHA2566b7c651e888ff972a352bce2de467b19bf5a379370c31a3c554128dbd4c62e08
SHA512b4610bad0dc65a7657687448944aaa97510cf964d46009d4dd5c9e8a7192fdc2fd4a710fde1652e3ffd41ef3f6bf5c6fdc0d5471aa54892d8b2093b98e5d041c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff17faa6aa6a8d05285e5218caaa2473
SHA1d87199aa7aa830fdee329b892cf24807afd67418
SHA256e3899e1ccee9eaeb26568c66a6431bd330b0502f52274d13e76e621da6b18b34
SHA5128d4a56ade77f1e3a3c0dc24a05bb16ff93a66bd122994262cde6162355a1163c83cf7a1a3250886d7a3ffb0fcbf86417648f45e1b7c5de245d81994b90054a28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a2178b1607e44f80aa076deff2c8538
SHA1c83d376553f16dd5c19490860122ac2d2e5d7899
SHA256f45b3758f4931847ecac448215560da6b42351c626854b05a84ffd7537931645
SHA51236589c77abce9b38bdd0b6750b723e7f3f49f4a6568dadea444afe223431455130b8d7cc5efa06d1985c1500991e3b17f43126adf21fb6c8c824f5c8b26fee26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5348386dc5242f6e8016625bbad25b067
SHA1bbb6a7af0352252cc43f141fafcf654a60d424aa
SHA256337ba394b1e0e9e80b9acbc4ec3fe83f9038417df354bac833d0b427a3642bf7
SHA5120a4149031fceb284a62848650255916a93196fb8de78063a53412c593cf6d997b883d26b5a14cdab07c9fb75ef60fafa8f1bd671a34c0e3f1f7952983e5a6883
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbf7d2bd4a2e1446e9e9f32f842b48c0
SHA11a5cf34ca40ce9c84fe79eb647b72388a95d7e31
SHA256eaf8ddd740c2afefcf9a3505aef9a2109636ce9f2822c2f1c330961d4eaa6230
SHA512e6b2b0dff3e5a83e36ab4cf467991f527db07dab86f391b5d6a97d993bf86d1e02770d83e782c8856d1882402d19a660fe0c58151d1a4895ffb70f023b72ada9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c5de93d7e729ace0560937972f1e0e8
SHA1c37f10eb71523cd07c2f5d7327aa0c57339b932d
SHA256e6cfa1f834404d8aaae2f344d2b67cbef966ee52f2ec2c6f3d2ba2bac9993d79
SHA512dd6357b4d73c101ab08d0f5abc59e6a4ef354267ec42c0aa2db7992c80ab45b17dc22de7457867a1cb8049d1409fa406812516ee37e0770442f63f23e455ec46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f20e3f563f95cd92d23f408bebf89c3
SHA196c3f0ea20d4759eadc1759017772fc4eabc52ee
SHA25699463b92bd0ea2ed453a95c79a840094b87cefa36e74127bf197aa51f48e9e98
SHA5128d174afab581bd3ce0d5752f81be5b1d68f48d8e4ecfd6ee9c746edc0ca732130db602f34a71e5d3f26cbb1d5fdc4804cdc0ebc0e839daa0099e53cd2bf1dacd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549f544b34fca42eca3d345b3eb087a42
SHA16ed76324eaba3af29f2b0043d5e85acbb5f9ad79
SHA256f28a29054ff89c1f2555df56ac08a8dc480a43aca714bbe2e4cd1880d8542ec1
SHA512804fda697cf56ff11ff1b3c142eefdf85525d205fd70db42457f2e3c20f8d4b3a0b691e7579a47c1871d6b6c5cd36ed61a536b4d37b436fbc63b9eb14b040b45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d7e08b5210d3edba3895f240cb24161
SHA1bcc970f2add1e239b7d2cfbb876ccba8c3c80d99
SHA256a34d63eb90986fed6628175cf05072900e358c8defe2c1d82828c2aac092910a
SHA512bd56a418be72408859c7e7644e81c0aee3752bd63f7f9f4bd3a502dcadfb90b78d63931468109c7bca9aee33bff863fe9da3a04c56e6c3d9c7c5bafdf52ee658
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56897e819bf04807dcefe93ab844b13e5
SHA19df35800ce7a461d5193e5d6d920b1e6f8ad5c8d
SHA256241b2360b39d0822094465d59849b3c8559b4ebb93d4e5d5c52423e2a19b7d25
SHA51236b0f8503c12dc3546c95a7b9db1f977bc82275a04b1cb681aea0d829bfab61af00d33c413a057c02246e630e07f6aceaac933b6662961cf92c1a3ac6c72d32b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537da285ff49194f12f079298b9ab0f5a
SHA1597ba58a1a2a03d25475eb0c34c86972f95a1d90
SHA2565bbfb3c1d97ffc0a01a15aa46459e1b64cf88712fa6de9cf2a659d15036c6068
SHA512bfced2b0bba49b081b9968d7722cd9c7b5e94d65ee0a7c505ce94d2b0fcf62a0c6531e504d028fd60ed229a1acc84b8003e1a7b514bd633d820617fd89615cbb
-
Filesize
48KB
MD561c3885971fb70f1af5f564af7e373f4
SHA1a1791b845be99b0e1996d66282334d6a5dbf459e
SHA256042b16e6550e0d41f762d429b1b571ef315c7afcd8e94bbfd4e9d7a9d55cf9d1
SHA512b71ff224405059d1d24272856cd613e1865f9b29e61aa35c7166e81817244f3f37fe3677e253043cdd8d8e6bc97d35cb42dde044ce1d16999a660242a14a57d7
-
Filesize
9KB
MD581154f3aae8525728eddebb41fc4a86b
SHA12a392fc7f7f8b96703733d07666d24a8fbc46eb1
SHA256d45eb6474005521413558e68fb828b3f8062d1a309fa27dcfe4dd73ba63b7009
SHA5124765a1aaae52d86c89b6b7f01dec432eadf1505240b7e8731f24a096ea742772f44c6eab960ee8d11ccbc52f4e84b1e2017d8468c4492e065845d2a1d31a1560