Analysis
-
max time kernel
122s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05-01-2024 10:48
Static task
static1
Behavioral task
behavioral1
Sample
437c29775d3752ce4fd9aaea423f6600.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
437c29775d3752ce4fd9aaea423f6600.html
Resource
win10v2004-20231215-en
General
-
Target
437c29775d3752ce4fd9aaea423f6600.html
-
Size
3.5MB
-
MD5
437c29775d3752ce4fd9aaea423f6600
-
SHA1
dc19b4fd312a5b243abdf6c1aed29511bbb3a814
-
SHA256
4bae9491ac91701f5bcde80700654d4d7ef50e7193236e2d8050757d49893e65
-
SHA512
39e424a8a4c01c89e65181289b7e86dbab8884bbb7701ece92603955e27d059e323598e1f3e4bd0ba256394a9a60faa657b0c5eeb6e22c7333eee1e144b0ef19
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NG7:jvpjte4tT6Q7
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000432d9f2199648539f3748223c0e1f2cdbcc802717d26ff9efc579fd8c6d1be51000000000e8000000002000020000000e843b659ba7108f0dea82d9fca44dc68f52a5e174cc3f49bacc557febc8a8a7d200000004d2ede6f37a47bf7b5f326bdb2400bd4c032d030a70cdf114e33bc884fbdf9a6400000006b7ced29e87bf3bb121155123cca9200f68a1a33d9364b1f11beebd8c54cea6378704cb711ded09c9411829c4c343234e19be15654b4f4791b5ecefc931de93b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8029b1d8c43fda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b695ea04f9498c868bf074ef33e7f1df4c743c354b932d7bb36dcaac7dfe03ad000000000e8000000002000020000000c6362a9d1390bbff4a3d60cb40d540609b648bc8b5adcf4684f0a2fbaf4538a5900000007bf2e1e7513ebc5b310f38bb7892eeccc2fc1a669fe164a98ae5cd7373407cc06a18c0ebb2bb19f4d969157f5dac04c34df0b4228bc67850d83afcb514916ebe856f565029c6495c46daf912448f6ed64bec6f499366294e9c2dcfcd6fc94ce3c906e3fa9a6ed8a0d095a28b4106acd9fc404aaf13460726ac08dcd6cd9fecf7f4ab8e4a1778d772d2b3e692dd88307340000000ef6e0fdb33ad9972f82f9c49ff2218ab09c81bce9fc271c000b16d88365e12f60bb3068256fe9a41ca09b0689be9cc2bf3e186831103d4cfc66d06310f1e136f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F16F8AC1-ABB7-11EE-8AED-E6629DF8543F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410613572" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2140 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2140 iexplore.exe 2140 iexplore.exe 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2140 wrote to memory of 2772 2140 iexplore.exe 28 PID 2140 wrote to memory of 2772 2140 iexplore.exe 28 PID 2140 wrote to memory of 2772 2140 iexplore.exe 28 PID 2140 wrote to memory of 2772 2140 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\437c29775d3752ce4fd9aaea423f6600.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c235671ba316ee1c6630c8787928ff3e
SHA11b73d1a8eb9c131efbc8285dd1eae15e8a506301
SHA2560b5ac7df06ad1a2a22da62a36a24327c4f739d5c8cc96b29e7866cf01034af15
SHA5124a425708d8e41bef19715b59425442302794428f8c890a83a1697c0cdb8465366ae3997d671693a5a8f5e03928bd0a7bcacdea75df26ce3877066a84653f44d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe65a13a79a87543b9549a03d42768a1
SHA10e0eee3eb8fc4c2788324265ff9ec113a55fff76
SHA256ec6cde90eb115111a9e3456cade74156a9dd94ce3c58907d66306365493235b8
SHA512a820442419b208f88182786d4dc2d5790209545e0db4b3f3b83ac0a7f6fb3c90ee19ab182a7e4a53cfc3eb86a873f7f24fbd3d1aecf90dba5fe02f4a735a2402
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514d9a22dded98c5007835b12c3d6f236
SHA10d784507a70e717c897b16eb7f3a436d637029df
SHA2565f46bf9b1e8b23e1253f5cee192924d99eb58cc472be71d18528255bbd755905
SHA5129f364946edb3b0a96c7fce7c38d3e470e2cf78d27fc390fd2a65e93d82e7321d503a44883aef3b2f2f16579f39da33c680eb0db62ea10a18ce86e0d88e415571
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f85a0d5bb331c457af73e0c0e8a670d0
SHA15cf0267b7c4b6ae69524e267ac097dbb3266699a
SHA2560c1202cb2a5a28f240da89f8b828be8dccd6423bcdddfc691f8f3d650c3dc58e
SHA51251def2bacd379efe31bdc934c09d092e3a2a780743e8a04bb1320acb834af46d1c5d65479a82ba4a22d07fe75db55d3899c378765990eaaa20c0c720edf36ba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e432da821d5a4f7562d575bb1b61ffe2
SHA19945f232ed2a98a074b00daee172c3dfe31eef60
SHA2561890c50fff6759c5a2339d891020cb26b6cc36bdab0ad75c701ec2e5e0dc5186
SHA5126d134dba558cdf94e140d158af05f1e2851100dcb1b4fcb5a6789c5bc63cb2da8091870c09fcf5efb37dfd1bb9f1fdf79d2fb61894fc3b63ad283a1d1fef5ca6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d5346bdd292382e05ed01f72614e90d
SHA19f6d5f4578e7547b37df21f14601d8524a46fd73
SHA256d0a457c8fd3ab8adda797ffcff78f9389808ad1de3e755502ce96dda312e592e
SHA51247593dfa5d6123c8d31ebeca773eb46cb5f2400260678ecf99d0421e30240b3faa95cc423bd6bff9958a74932cf8beaf0c3a4a5019980fed9f0dbb1e8cf18d0b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549cbc5332d3bbdf4c19c47c740e3bee5
SHA1e15481b2b5a14523d6664ea3ebfb8224d01d0d43
SHA25686af6a4dd05b5fd8dcb4c3fb3a21b710df592f0202bc42f4d96f8ad3c47eee4a
SHA5126941fb76ef1a2b0665b3ce884e60c510aa8778dd598d7af66a5ca5a7dd064e63dcaa2e45139ee7e175e62715830861ed0cf672faef668ea9b6361bdade4017b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e9fc6548fe4c6a461687fc15cb69113
SHA10d826ced17affa2eb5b42981e81aa2d3ca0a9688
SHA256221c68107db35a5fa7a611f3efbad85ff6cdcdb3aef01c4bab37640d99a0dd46
SHA512afe69612aeafd7633a1daad97f94f1a0a1a1b8c52968b94ff1beda9ea9d8866b2885c2519757d8b15ebed08e33d73f20b718c6a124c92791999765d59e5045a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f642aa617641fa4c9c65d06a966a2a41
SHA1623123ab4a9d20b0549ed5f97b705af5dd3759f6
SHA256affbc4115586ce13026c6cf0bdd431b7b4069e2bbc2ca52e92cdf4ed8ce39a4a
SHA51272154d1df8ab18ae7d1379f219717d78465bfeae81b38184ed940310a2bd659408f1c9a441ae42adf622bcfa868f2351a0dd5e43469801a5e31264416d054bf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5666e9191e043da24c56255e81e3ad0b0
SHA107d5cbd17db543b4867272138263b0940896f5bf
SHA256fab1b506c32ca98e179cd2631487aeb8677ccbd8f5b90f2b72fdcba82bfdb0d4
SHA512da88ee488e0b5cb0a68aba86e2155993f9fcc134bd453b12a2cfb3e55c39a1d8257a32a188f9a803d451ff1b826d247fc4345c1fde6fb2b26de3771d01f9f7d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585ec0753801621c9750e54c6f7bf1de1
SHA1c39c21547510a7859429b0d50d9ba58426b03442
SHA2563a4f355b437185df47ca0fc59b80e11cf3064dc48e99a8a9603c9723a88554b1
SHA512d2086bc49663d6a38de98d984ad9438607b2d6033d7513cefd90f8b9480c6e129487de0882e4ad2b8b62b03d28c5e08baec1ff5429cfb09305b93a8fdc38d4a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1a225e31a119b131ae1415b89836c24
SHA18c9cc268f65b8962eaaab1e4918b62248a108a99
SHA256645b064bc6184f37f62318d0cd572b05345869b1a739a0d6ec2f5d32954db349
SHA512dedb2fb73a8b1b5d8b471ce54aefa9fc08224043557e4e4f6c63cbe221b150f764783c37d26eb55e15f261595bd40f46c527c1a70233e3a29b0b09791645144e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f19e289fc8e485c2f05b641d68f0071a
SHA1d5063d508633d1624739ff24603a6ece2e123561
SHA2564bce9ef863bda5b953a30669703113145f88132b8a8267b7801d0aa6df694a6e
SHA5124e86a32a7d302d7c2c45a861355c08ba4380bea4b2debad05353035b78feeef4db0d8358587b3b552b1081c7de04a835bb93cb8d3cb7ec4132b89483426cf45a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5137b1fccbd6f15d93c249b142c26982e
SHA1ebe1f0dbf1be7caf7566eccf2d3148f0cafe7969
SHA25690816ad02685cfe4413e59d91737b6b4d7324d269750b10a1405a17536f20474
SHA512352114c43699b27379e7f6e27d5c35f2e4195231da7075fa0471cb76f32d052b8c557c582942f041dfd9f9d228b1843e021753764e8e0fcfc89e165e808b1523
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513fdb26aef60a7f73b455c0e16508dc5
SHA1bbac74f5c2d7832a131427998260e8464dc5ab12
SHA256a2c33f28b225ec3cc78d17745964b384e5df0e1c58e8fce03ac654fe9ce4f609
SHA512dbf8a6c322c7615d537fe5e978b5fdbd1faaa5f8cfac58545bd709f3b347c6d82aaf44ae4c7fb0b8c8eac903a2bfd0dcfc154f7d0880f8e479fb27bd036109dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b81d5d3bf0e8013278ce2db79d073566
SHA12cd94cf103a3cf709dc5a12abc013df70ba3484b
SHA256d98adf3c0eb987b93ccc7202b148a6a9e541fbe5a9203ac7ac402de85951e387
SHA512dad24bf3bafc03aeea0bfaff12de9f06a0ec1e32debcb6a109e374d1b64ed9337ee212f6c145b84bc363f83577399cf24835290358974572b9cec35fc02ac233
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06