Analysis
-
max time kernel
0s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 23:07
Static task
static1
Behavioral task
behavioral1
Sample
44aa70a3fc685e3610e2ff9d5dc61e94.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
44aa70a3fc685e3610e2ff9d5dc61e94.html
Resource
win10v2004-20231222-en
General
-
Target
44aa70a3fc685e3610e2ff9d5dc61e94.html
-
Size
432B
-
MD5
44aa70a3fc685e3610e2ff9d5dc61e94
-
SHA1
eac566a43b324c92b219303be1bbbd26eab57125
-
SHA256
d14a58e0b44555125963b88b33404622c1217d3daa969c04976c5f7f5ff00058
-
SHA512
b2f9d84200a9bc9172d2b61dc449efbf3510ae5cf949d5d1b7d439460d70b4d82cafaf18806921066bed8748c676021b666c9fdb0f52014c23cf7dbbaa976e2b
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E3E3561-AC1F-11EE-8A73-D2C28B9FE739} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3028 iexplore.exe 3028 iexplore.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2436 3028 iexplore.exe 18 PID 3028 wrote to memory of 2436 3028 iexplore.exe 18 PID 3028 wrote to memory of 2436 3028 iexplore.exe 18 PID 3028 wrote to memory of 2436 3028 iexplore.exe 18
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\44aa70a3fc685e3610e2ff9d5dc61e94.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:22⤵PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
32KB
MD567fba22ee5234797dbf7ea6a12d69ee7
SHA1e2c897429adf70c48c66f580ae11d6e819ec198f
SHA2560f884778a4bb873593d2aed027c83008958283492fd0a15348378b4f3aa3b51a
SHA51274159dcf8362de996fe13eafcc18ec40588f814e230ef97774ad413241e0f5aaa00da38baa6e49a70f81fe6e4a7c15d01124e9da659754a38ea2e7f926cd0b71
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5652962a86fab43497f85232be28868bc
SHA15e0ae665fb9cfde370565756457d7637bf704d26
SHA256eaa453d4b0acf0d51fdd580b56917b49ff72f7fc122fbe641db31740c87914c0
SHA512fa9c727381e25a1df5e1adbe205aa0676376c6793fbc4884b95ef960f68c00779c60c524a7fa3c4f61994a29fd9dd6f81d29eccb7cfb6b438dde8b88f0a7104c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD549a6a7641b6c0174333bb6648bf0d63c
SHA1d5d2823b73b1d723e765e1e55fae5d0f2a1a421b
SHA2564144bda9d6f2d431543f6f776d189790ec8d0b59785ee98fafd3e158864d2ef1
SHA512b5a67dcbbb23f99b13a83a3fb0202f512808fdcabed780e4186830455071e545b015e9469e4cde45404b0b41ff14804395c09895b87e39557e9959797003d4b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51e6ffecd05d4694c3599c62a396adda2
SHA1fe0e766568304b6d645560ce5a3c12ac9c9d2c83
SHA2563385e69a6416484c32e7f6cf5d39f2e31918b3d3c566d0d57f9cd063a983c538
SHA512fb93e07b66fcb8c7c20e784d1f51ffde4cf938cee9ea5eed0c4cae6cffe3cff527bc404984118668db9b596c541a6f6a931d59c3a8aeb04b0730f69e505dbf2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56cc120984ad09a66e054183eb604e94e
SHA18fd77a04cd3ddd3e716963030ae574e17fefc8b4
SHA2568ce894a22d3cd27ea84a7e915a64cbcd54bfe8603008029d2d07002eb490a049
SHA512d9812ad930a29b9e7ac8f26e7958d49d25784669f5752482ee34dd6030c9409662620dacbdb8322156cfaeda5331dcb27a47178974a68c2b5af1b4984edb3058
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD598bd402f3808b10ec0fcf62a57ee45a9
SHA191d352bfb2a98d3821204f9d3a2b799ca5cbf3a5
SHA2564995140eef81ac7a80feacab337a8998b14e71da6cffcf4216bd4977f894dcb3
SHA5125dedcbc2cdcef4c357efc7d1effceb26fd21a323b93a99ba6e0f4b3df4e11035395eda9f23a383feb7866650f48aeef828fc32318b59716f9866a81ef53894d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c4adb56338959fe8162f02d374e97982
SHA1c602d1ed895c9bfddeb8379beb19a3916048f9f4
SHA256510ff2b0283e7bfaaf648e61e91a5d3f3918c48c1e9e5036cc2aec84a77e1252
SHA51211faef335c77d9d7e6e52475a1841487940fe5fd8b9af54acfab7bd0a96f2e1453f7197cd7e6c3e5d064ca1e2c0a7a4dd51bbe464b0ade17dfca81e85303b001
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53949eefb87df01b995d90f244ea31db2
SHA113b7b201852bcaeb8accc8995093474a0a0cd015
SHA256b455f37848d614b4ef1cc5f27199b49fd28ad3bdb4fcef51625faa9281ab644f
SHA51235365b20b9b8f4b2af62abf83dd1b0ae277f74c8d332089c2dac1af4b43b58ce091a577f1f82937159a06e9e4216d783bddd580a88131626bd382640583c8d86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ca946d12879402fdfd949dcdd14520b0
SHA1d0ea0ec56f72504368878728c3912a7d85863167
SHA256fba7a70516423d199e31acd0ef24f889063337936a52e80e667d8e5c03869090
SHA5125fa8a042f6c690fe092e802c742479e5e59c95e76c86dffc6699bd7a29992bb1f2a18a5f7e1ea8e6b06387d6e2a310231923ddc53f14357434577c09e146d554
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD59ced750a1628d587f385e207feddcc64
SHA12c74d89a4f9b2994df6576bcf1ff1b2c03bd9f8b
SHA256eac0ab881ebab2d427036e6d19120f52f519790c78c97f93ba77a4199d909172
SHA512e16e3b113b0105ac9745028653512a3e6049c745ee7f31553fb7dc9b531c806cb56b811f1a41c46483a028a53d8f482176e1303df5a9c96b4ec0fbea51b1c8d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f8b9155e789ca2f8908901baacde2160
SHA1f2756028841c2ceb6c91ce50fafd0fad86e90248
SHA256ea32527ecd3a92e26a7af811c250cc75250566db73d53469d73c0bf9eee65eed
SHA512dc12a0e2df3720965053ebe5fc83568193cf590a8fe8a320d938a31a5fd39207930898a636b9eb4942d1525d6b0a0f80399dc9d71e081b06ecd22e5363d3fd4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55770f25645a72753cc2986cb8a0a5abd
SHA18021a6bf2b5799f3daf48d86dee0c5942436fd57
SHA25620c7215f73bae80b1de2828264500d092b6472c035eb1bddb6e5dcf46077a8d6
SHA5120cbff8fbb91e7523ec1c2efc406e9a4c3853e47cd62512d0102e628d72e62bb8f4aba476446ad71ab8413e04f462c57429016b72dd4540d124d62c58fe1ae97d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5294f85c46a3f7a1741bd0249d77bc599
SHA1bbeb7a8599f92c84923d28268fcbacb974b7bfbb
SHA256df662fa414313f31cbf426a8d4cd8e8eda6c0e7adae6a4b200add6ba666f81f7
SHA5129fa8e3cc1723ea9dd234ab0c1377cf1632792d006523ab441d97e02fa18e551086d66f9f47777f7eca80759589c61076088bc2afc73beddc2a4d4aca904ec69f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bb71d8c80bd1c27b8122e235ab09dc5a
SHA1a376095fc3af555c71a7d07d28c83fe487e435e1
SHA256767f88ac0eaaeb1cbdac87a949663c11c11f7a5d7636258e7cd4134170a71853
SHA5129ee31e82e02e38d13ba1c55d336838cb31d9b49d1fb08e34e51040efcc2c2b6e4b15201f5b3c3d22ac0bf007a6948e39aa3653ef598948eefd1854f929ee9648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD547f81cce611b02e8230cab010a0b10df
SHA1ee5013e815975e63f5def2ad52fbe38a35eb8cf4
SHA256aec7682babdb3b0f44d4d099f6216ac52ab56fa2e4da740a03714ce3b0041e7f
SHA512b2f4e414f749259981d8ccfd1d40a9d030bd2c978c6774dbdf47f9cce50124fdc311e9d3d8b17245e483e7d89f8a6304a051457a930de05e51e80ece66496278
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD599ca2c98d721a4b29e6b93bc3a5282d2
SHA1484e029c4386402aab8a4c2c5ee7312009feca2b
SHA256d2de15656c2596f391cd628bc230c06cb5963031b13f92ed6728fdb031be80a5
SHA512d17759911b99d6281acdc5627bf85b3fb93d766f21203201d291abc720c452696be8c230d19c259c5fc09958d9be3b0381945349445a21433281c9f2adce182c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50f87db773e895f24b09c5aeb9f6a3b88
SHA1fb28f7050901c2ff3b6f95ef7cc90507a7512aba
SHA256d028a85523b4a71637f662ec6902351856663799720d5f1b2a8ba05666a4cdbc
SHA5122c3325dfb24d635f2fa79f690adcb324246801ea988be34dcf050319daa733655a9bfe5682f2882582545a5621dc79b6db78e1c62ab2e4927c59c105e52f0617
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53502aa0a2cce557cbafa7f840effc4d2
SHA1aa67ef040beedeb2dc4ba3178ebf78414a70fc70
SHA2565aa698d3de8e78ba978ab84dd644721c1832202e6c4c5d6594e55fe888b12f3a
SHA51213d29f66c161a60a872c5b77f62c652976f71bed22846e977a9e32d38909e372ca3db513463757e3cd433765021f9273e25c68824e85d0daacf7398e7a7ed1bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52a1b86d5c9d1cb52ea5fc2467760d5f0
SHA150d00d6198f0a5a286501609e2b96a8069b833f9
SHA256f23e063e714f38b2cb606a398847f452573e36cb2105c67f725c891e782ca8d0
SHA512a111debc15bff38e8aa741e1cd500dd0c7016e10962ae4b898a9b7265f46d3c708b62804d243bb7c0395450fa8dd26746d18c291254333618be4813ea999af52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD586d6c41d1ae43580e60615a4bda9afdf
SHA15cce81629717ed31784e8ad050b7173eaa60d5b6
SHA2561ae4f7f639f428234b23f67bf2fc6190a0d8c3b8c22bc2ec596908c7d6e1b3eb
SHA512a7a75854decd4d7b2849b0ecd70a8b8bbd4a21d53421b00b3a18f9d2e18f8bbb5fc65f55461ff25fdd6a4de1106f8cfa589d5bfa03916c92d41cdfa96ce6efe9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD564f9bbabd336f21a33c8ff416f15fa8c
SHA17e3735be831fcea238ec500b12de93d3090a83f8
SHA256dbc9ef0bb724512f2c690d5688eb7bcaa0caf606890fd401a32fed2b40be96f9
SHA5128314998a77ff70f6ebf47b0d23819a805427a7c9b15c084ed8cae375c09d8332fe9608cb30b3ac53ebde648da001374c265fd10b7d5108f43366e3d2682f3f4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5064e56c08e6f5bb3abb933fd82ebb967
SHA1ab19c0159c7102a629869bc7826bd280bfb1ed60
SHA2567e73ba8c5164b821ceec87e51e8823a1a840e03ade48d42a8c146da773acf067
SHA512b66f3a5c0ee7db9446a8832414e6bbd74c37d5c5a332af1978b5beab8ff2efa6e6a6140c6707c6feb3196dbfb6dd595745bea56be304aed70216989fb1f30dac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5293818c7890240d3a33d7dca744e1c2b
SHA183daee00e622fece6f02e98d4f9b90379c6d2595
SHA256776d505be420f4092a2d7a14704c4ac6e1394bd6d55aaefa95bc2d692e68b2ec
SHA5122a16ac4f261db99af788f31afa9339ca68d88896e196d6f8de21c018271225988585c4a23f65bf941c3c1db68896e7f0e4e337c211a85bc2cd2e32938800bcd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5bf449d3a5510766fd42e4dcfa200b1c1
SHA16b01b3421d781ac6071f036622f91f016c49427f
SHA2568761aad41011c8d16b31b4171b93eeb58a8814ada12154c32700ae654293a39a
SHA512a30401499a00489fb9a22d2a12a1a3f9577215f2ddcd05d4be7bf0d1c9b27df3d5345b0bc1d783c76ee07d8067b1b3389059ffb23a63e37baa9131e4c0d71092
-
Filesize
1KB
MD59cc56823748e003f8d326762f2086c10
SHA1c7704227ab21113365b6da05dfbef5c691609bbf
SHA256f5049015d177a4feacdf49e00f570e98e3578caeb7be377fe28a67e4530e0a1a
SHA512ee9d0467bbfcdf6ec56d473e029fa01b91f71068a03e9bf033dce372d14eb546331850f19fcd038f18f58c5a76a13cf9ee6168e5e96d3cc5a976c996e8a94db1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\14OCEA0F\favicon[1].ico
Filesize1KB
MD591abe01116ab422c598e9c8af72cf4da
SHA10f2815fe8e067d48537ad168225ab4674271fa27
SHA256b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
SHA512a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c