Analysis
-
max time kernel
122s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 11:40
Static task
static1
Behavioral task
behavioral1
Sample
40c39ba472a6924de754eb1184f97448.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
40c39ba472a6924de754eb1184f97448.html
Resource
win10v2004-20231215-en
General
-
Target
40c39ba472a6924de754eb1184f97448.html
-
Size
72KB
-
MD5
40c39ba472a6924de754eb1184f97448
-
SHA1
6111b6ebc6ea7e984b49c1c554cde3d101229d45
-
SHA256
7124c7baf8e5d14e2c96aeb1dd168ba9bd1f4a5811531afd44584223a92a3e54
-
SHA512
26fd4054b528b65066992067effb51f659bad48daa448dff1ace5182792f4ca57eee9c4a5a122f62be1050e5aa7851896464263802bd4be97deb95cbba7b8ee6
-
SSDEEP
1536:NaplnNrueFoRo0kUKVLc44cjwX8vFpMw7n:MpFJueFoo07GLCcm8vFpMw7n
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410530334" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20787afc023fda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000008e352082aea8c76022852c5048940b3436dd104d47a3a561441759a69000a179000000000e800000000200002000000089a0b2eb65a4f408d92358e7ee20d79751715e52ab941705f3a76e1b73badca2900000005882658cdc7bc5da020a277b3da4da19229e8b9e355020dbca85fce755a84c8665e516b7b0d43b04bc471eb93f5fc58763c243fe1d4b66895ec91e72edd7bc942a6f7594fcb7961de1d55e24252f248da40bac917d126318981a7b75902e18d044d96c200f7bce6926aa9f161ee3707f333b80efb05de904ef115070a4d2bfb6cd73f3c52c97f7e3760afdac61868c544000000092837b2b8d820830a8d86e05bea8743fa2015ac4eb77c024a8281c7ac2c847cb58437383b9f300f289d47255f46a0030a213d21b6bf21eae38cfb3adf902fa19 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000652d956752be045cfc4601a8bfa2b439b9ebbec03e3d213f9e61f8a70a87d3f7000000000e8000000002000020000000fa2e1767a091f4dceda8c6b0cad888384ade2f24da84bdde4c5c1cd7a5adf76720000000e0fc109468e1681bc6a469509df1c1378a2fb466a695e82dbcc581bd0fd3cb1c4000000039141e07b904af1f1502248baf3c9fb75586bd81a2a8971221b081ed584669e30953a518ad7f762403a780371d90461835a595d1d7615393d1e5cd1e8e367339 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{241A8AA1-AAF6-11EE-9E63-EE9A2FAC8CC3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3044 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3044 iexplore.exe 3044 iexplore.exe 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3044 wrote to memory of 1404 3044 iexplore.exe 28 PID 3044 wrote to memory of 1404 3044 iexplore.exe 28 PID 3044 wrote to memory of 1404 3044 iexplore.exe 28 PID 3044 wrote to memory of 1404 3044 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\40c39ba472a6924de754eb1184f97448.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b886f3ef35e471a860a50763d6ae5e8
SHA193a5866b0cc95e0c84d3909e4daaa691d70c0a12
SHA2563192595be6ea305554178042f33f83a90af8ff151c32ae7b84f859fbc768c5fb
SHA5120f9e799366f3340f919d4597148c49042351c3ff5e6ee2dc9a20e491b08e930b8bd60e884f6be0b4e84b6aaf42987eb894fb17ad3712ac54dcacd6807a6fe30a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc640d86d8305e8e9f8fcd79c985bb5d
SHA117728bb7f49cb1f078062a7bfabc537f0f173ccf
SHA25632d04677fced6a7963186291c97ae80e3db641c2633302ae01a6c7d906cc8afe
SHA5120c806fd4eb3ba68b0297b99094ab5154c8f268ceb99c532e0500acfd20a10b523452e98819d77071f727a69e7229b50d607697c02ee6c2f4fe702c0556a856c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5597a4fabd96efd73057358c3fd1f9588
SHA186a9c17636de626f2d7d8ee1cbfefa75372f729c
SHA25621adcd390e5dca29b63e0d739e5c4be656b93320b91bb2540409c869d19e5ac6
SHA51214bcb1eedfc41b5a87b00d541c81e2d41baca16ece1771e8e250fe336dc688fa139be80167c6a7307e8ac30b177a1e7bb1f590b4a0ccb574d64cca008ea539e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5251f32534209ba8149ba887eb2d10069
SHA1e3e6bf0abc01fb517c925e03837c3784a218b3ca
SHA2562a4aa18fc633d93125898a0c3c7ec7fd66339a50a5bf7d626fad59b50ba1eae8
SHA5122bef4c0d7c8eb6ce0d9e831ed3ec5f86454afa925e8a06dd6b09bc0a09dd2be08d1908b16fb65848921329f223a4b58c5475c6a05215f517911eb3f71030bfe9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570b45067b11ea801ade6c1f3e459c89a
SHA1d684fa5427d7e9669a4f79229dc7fc26cbac4156
SHA256976d9ab0d8f9d9aaebbb4addfe573920a788c11d53eb16c65f7032b2f85f3b6e
SHA512eee52e8665ff374c43588ff4a4085e20f11515c5f178c29b85f964a37e68be67f664b52a661e556a5a595ece2059db7be47e1b580cccd6a7938657b2bb4da42c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3abfa6fed96419bf899a584f82f2402
SHA1b52dd3a55e43806b6807f81fa1334ced802a93cb
SHA2561a67afa1c7f52d3d19609921e5bb1de3dcbf13a5efd3821379679a9710742d28
SHA512501a5eb32b06eff434904ac12146209371e8504ea741b97ff709801bf25ee01382be9b54f46f08f5647461e38f03ecf982dc07af2df118f8460f50dcf1fe556d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb16baf0587a37c0254d1a44ea191cd0
SHA1cfb154665e8e1a89232b63d9997bec1f727471b7
SHA25640f73ea28c2b59e44d11b4a3f988adf4bcc2da53915d9537fee937dbf96dec32
SHA5123ce64c6f46b1b2cefc677394a064ec9883023d2ba1beea0d2c17f2be3fb5306b5adee64aba360229b0bc3dfe38e80b5fd9b307b1cd95dc32c0772755beec2466
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a849f57bf905db0b844a7da9ee8df1f7
SHA11810615a0aee1f083c8591ac1edb03082aeca21d
SHA25607667a6da41d51e0b0d98e8d7755ad94e8d36e92fa0cf8207e85e82c55d3cce4
SHA512c54a32d1127a3e065b4ec457e54f69ae7a162ae61ad878219e17ca26919c2e783f535c7b8000020145bdb5d959e1ca81187ecffd23b18addf2df06917a396dcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae83bf810a746f59fd7bf9540cc5f362
SHA106a63a2831b344f5d043a0fc761bbec2491ea5f2
SHA256ec970f1fa482e9fbcd4629464b1a2853d34ab1f616c09a2a2bad47e989941a59
SHA5122d8d855971eb2af6722f44d0dbcad0b0921548d9b14a83548e97759a88d9bb8ea76e72d9d15ee474ee764c16487a3c13bbe136f33f801b8e1d42b684e8f895db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514f934e1a94f3f8f2abba7d3a13210b5
SHA1b6402d94845c31e361c5e0afc5abb2f0b9605436
SHA256e2effc15b6e0884dedbf52c31b6c3f906c5e6e0bd5ae18d3d81e15ca259d8560
SHA512fe288d7abc21d7201590b72c8e039c2282b27f0313838f516abfb81098af0508d84a8014b1012d22f4147fb731ae5a6d5a82a4cb66fd9d2d069f5fd98736f53e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5738da112b96eb49616f6752214ec8047
SHA12ada20bc58e2d6aa703103c83fa1aab6f7c18ff6
SHA2568782598cd37b5c228d48f1213c2b0decda531da7674a0e944de19a222394a776
SHA512f188a37808d920c7c1cb1beaa89b62626753d81052ea75636656b9611f6bc7ae59ccf5ba92973b2fd98d5e05818c5e93c64e8ef6239ccf80b6395c65f0f7ba1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3d9382738233e448ca7a1ec6129a3df
SHA1378faa3761a00c944a0adfa40d690311ad32346a
SHA2567fc90d1f50f831b0aa8f4438a60e058757a66a8d4e6d09add0d9cc5de9be1617
SHA512a050bcaaebf78f0d058423ff707ce98f5e107bdaa7830c39aa4eb092622cbf238c27d6833b277a840234a9a1ec2046f77598a17381f9150483517562711e8162
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9cc76c3eefe4034d2c6840ceedeaf32
SHA1da35b3c2855accf707f9434402cd43278c8895ad
SHA2565344a0c3120b4d9eb336394bc5b1878302c7481619923849f65db80784351b3e
SHA51215015b6bd42cb9d5a85b96a8d402dd8a06dc97532c3336392eb9efca7fcb1a5b3981e73fd1f2e7047f53b9dad63c6af34846832c5ae6902025effb03c48d6b93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7b9b59a2b2cc8e53fd8448bf84aab05
SHA1a5f9637811e1173d20caf1486824e4308269104d
SHA256a21e5e55a28a67fda0f2c150405bb4f54a6c523ed63cc53debfa4fd76e895381
SHA512419e9c41e2c1bd06fb8e16c7d0afda8bb4cd1be53f4ddb370eb5f1d21322f5815113edf3e8f6215ddc8e7105f6b9ead0edc8065efe410f7381d43a3ce294cd26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5569de4fd1cdb09ef55709f7649511e0b
SHA11cedf27dbd403125d1516bbba5533cd06e7299a2
SHA256ff84c48dd27434bb2593ad43c9d6639531b3abc8863dd58d2c2f77d7835be506
SHA512571cf7646a5c40aff52eb27f24631f6c144209867d5871cb93ac2584b402f7f699d2c343489cd90d96fafc7d5a95332e6ff215f52368c19cf9ef45088f666b9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e3fbab260808beeaefc991b73b42d36
SHA188593c49071391126196e002d1d63e9d072ead77
SHA256aec5bf65c6bb8f6203b5d4ed5f27723d246e241792aa9bfb445b80236b5bbb46
SHA51227da1e81a850b896c4f543b9d23f5978df4215d524fe251eced3bd55972e008896a0c3d0c0ae8b960efabca869b372d0ddb7ae12ac5fbd7d3fff06d3839a4dc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5970787f851d01991976b7019f35d3a92
SHA1ebc816f8f82fd52345ced6e16dc51b90178cf9e7
SHA2566ac92b2c071bb812aad46f398c4e60cbcbf253bed4f8d83b59807045985707da
SHA51295cbdbb986c7ac819e930264219c4b8cf983e9acbc5fcec7f1b66334a345541f908c1a43534795ca36e24943a1ce50083ba82e442c0b0efa91b62b8e5eac1e3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55940d22c5251b895803edf45ca4322e6
SHA17dbb7e421405d6f56cb515c09690ad1ec0e13008
SHA256e580210b8992eea4c86626bdbe47f7d874a950348af2dd328936f36c29164423
SHA5128f47ef911293e34773af855147caf313c1c696bb99edc71d560cb6d371609c42f7029b0efe88b16c66f0730f2a6e8ff1d2bc3363a82fe15c78b0837bde308b50
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06