Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06-01-2024 19:09
Static task
static1
Behavioral task
behavioral1
Sample
46fa32d78b1f8764b27c6dcac4d636a2.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
46fa32d78b1f8764b27c6dcac4d636a2.html
Resource
win10v2004-20231222-en
General
-
Target
46fa32d78b1f8764b27c6dcac4d636a2.html
-
Size
18KB
-
MD5
46fa32d78b1f8764b27c6dcac4d636a2
-
SHA1
4cdc19751db598aad38ac9e3a9b07b47edee420f
-
SHA256
2afb0b5dbebf88e954431388d57ea55ab496f12f643b2beb35a4baf5e294ddcf
-
SHA512
f7a3552379210280ad319004b6e609b7463957a57cc46c5dc9687c4a54988cc33015af6fe83c70f6b7bd31fac684e2741cce33d2f292c36e0df169be61758e09
-
SSDEEP
384:eV+FNSahr1AgdGgs8jMaztTLPAuz68MMv07e:n0K1AgdGgs8jJO8ts7e
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 006ad209d440da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000fa9d3786f9524fe083005476b69ec9f8b2e78f69416c3b3272a9164b06335c4f000000000e8000000002000020000000f6f590ed75975db1f5e3ce5536616b5a254a2ce0cca27ae6fe4b3eec16dbf62490000000256b66d9370028a366be29268bfb2aaa8fa74cc1f7afc61b01d372f99dc9e947b8886a53b22e58ba17fb5fac2b38289f1a3e67464f80c9a93c551d762b9d7a8dc0141fbc7ab3b88f02d3c4a7860691fd71ccef0def318170164bfd618b596d27123dc02961cd77fea730fbf4e6d30db4831312b22e089ff185edf8f9e6659f16bc261aba2a32c351f051bd64f4684754400000007043bf6039d47e49aebd2b42c137940d7ace7c1db9099526669782b0a3fda130f94558c9996de52e780c7af4386ae4e6fdfbf3a134a097f8e000a088ba5ef920 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410730069" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000bb9c81a8a1f520068de883c6418b8e3500d9668bc944dd19a33d6f9ebd8486d9000000000e80000000020000200000007142ed3ec81dc00d82734fd85f223c3edba538891571277aebd3ccb0ae6763bd20000000c84dc4bb011d3da7a063952c0c6d377f41632c187769cb0f4257f18a6faa5a3240000000456667e5802b7b763e524f7348868599b235dd2c6c6e2c52a5f32bfc9d17f4e9798b3d3cb7dfaf80bb6c42ec72e753eec93a7a2e16b1ef4ad76e998ae2baa064 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28389BE1-ACC7-11EE-B2BF-5E688C03EF37} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2076 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2076 iexplore.exe 2076 iexplore.exe 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2972 2076 iexplore.exe 16 PID 2076 wrote to memory of 2972 2076 iexplore.exe 16 PID 2076 wrote to memory of 2972 2076 iexplore.exe 16 PID 2076 wrote to memory of 2972 2076 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\46fa32d78b1f8764b27c6dcac4d636a2.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfae8d287124cdf9b703f65c90009ae0
SHA102290048330b2635e42049da770b20f2acd61502
SHA256d9d3b6ae9bd232a5ca384524951dfbef9c01724ccc1920d824a939d09c4906ce
SHA512b05275b5b0a3160d310b95e7be4dd2584794fc29e0030226e34102f2246e4a9e86f76cec3961d072dd9b8defdc8104bb06015b61fa6e2b2c377afdd20f2fb22a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511d0ff94d9175116657a26d78975bb53
SHA10a81552a9103000bcf25c81126e7488d0ff3d5dc
SHA256007b254ab12df10f9de1fbd9653823d7d0652fd43f5e527d8f3b719994842bfd
SHA51224485db83a3af08b3224ff023df1f591d2418919e1bf86d98690f3a3ce06f73b7360078e2ef52138f0d3c3a500f13adaf6ce087edc79450368138d3f416bd7b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558cb5c6a577b8609f8fa9785ba6119e0
SHA1edba9ebdbaed70a44694a5999df76494ffdd5786
SHA2569523777d26f53a76e04f7bf884b9d04b4a0c665fb0a34a93f564554ae093ab30
SHA512f3806bda9172f1923b560a99d62d4a16aea7e6fc5f5489d812b02ee2a607a6665dc81af0fb672a5d9ab7ac176c9413d573b46c5e60fa397b174dd5e308503338
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddd0a2a407a4f858985336c779208e2f
SHA1964a9248a44ed7b14f322ff3d83a41b947a78cf6
SHA2567633df691a0fe1c78c057b5b7cc7ce9e0e657a4918542685eb7692428b4d442e
SHA512342b783dffc9b2cc8ee4fb45dde8601206e5294a8b103d4e31152dbdc8b8ab65609d01387ab354ac8bd7eccbcb27602c66ba5ddd29d0d3ca95fe3bed11f6095a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9caca7fa784bd621c4a75d30f13686d
SHA11ed09f8c6b8a142e8ac6367a1da8b5d9b499d14e
SHA2564148e9a76e4528223e66a210ee84c08c0e2a70b0509b14a05cbd461f220612ed
SHA5127e0e97f6f1c3864997f212d08e043c30ae3b408586e86c00d46ceb86aab8a67647fd7c4eee9a8f04e4ce4b5a3478e9d776325ecb4973bb03b067bad3064ba920
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e8b2696730d6554b69f599587e3f270
SHA17f32ba98d69130913818c7422ff4d6e7c4b6ce7f
SHA256332ffb476f3bf295fcabf2dca7548b2a9ef66971691116be189420b0ed4a594b
SHA512fac7fc4b8b26ab2667b3f6b886c146a3c036ddbbcd7ac39774d66d8e35ee10d960502a255faa8db00248334833217bb99fa9879c543ed31ebd63f4c7d126a984
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590b2ddf0f38fbc829008ef4e8ef68798
SHA1807fb56ba91180e4788b8a05e9ddf2568ec9d56b
SHA2563705b874994397d085d3f487297d99ddf6fcd4695ddf5d325dfb7e155d23dfdf
SHA51291282f22cc8feaf714b608e4a8fd916434b8a5a4258983dc429821d01bd86bb1120cb1aad5440cff8aea787008913ef694f761f2ee1153e66a0277cd9ed65043
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c61a7fb0d0cca78dfc5f492e7992726f
SHA1a5315ee3d6348149e79aad8777e72f8d39436f4e
SHA25629b2b1873d89a29fa7758378ee96f5b06c94a4f1b7416d67863b3285b2c26434
SHA51225ed21ddc2a9f70c6702588ddfbafa7c843cb3cc5c10abc08b9f4a69a91748b0ecc2daf95371739944e8605c5994c6557b6b78fd46514d6b1a05ef3f002da53c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be458b013e7784ad8353096be14880ec
SHA1c8150374b159a789a9f6509b82ea9941f15cb394
SHA2563a0557a67cbd2d98cb8a094d38a53570e6759ed3be3a6c4835821d33bbe328cb
SHA512df402eff686c6f74906a93df4e2182e88621c7936c463017444152a598f611b5a587a9136470f3e9cb9b3bf3dab08ab9c5cdb796c1fca42b42833b2bd9d69ea5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5545edb6a2d6a8e6e35fe656ff4ff5c69
SHA1251974e1b7ea67d6e2874a9e806800837af1e849
SHA256e126580780c9dda8b7a0bc82b6256fb8ce761d49a257ceea7e8a2c4fcba16bda
SHA51276ce40df79e61236856c50f057b4b5e30b52d626447114f399e41653ba5beffd393864a1ae1fc84365ae7439773e414000fc6a8a6547dd69e7c8a9d494c6ba9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f52d99be62f541fee2e5563d14e8da7c
SHA1a71b5425ddcbd6d01a24034108f8d38ce906a04c
SHA256ca57a27bad56c80d9a6498491bb5f82150ed66872ff703cd5267b1928a01a390
SHA5129ef55196584185f81d7a90e44a034a5663398682dac5c392a2394965a5ec988065c2359cdae76f7804acb68ad4f4439d293e179ff761080b1ccec17706ae4b98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff0d48aec5e945b0e4b484d6aa7f0cba
SHA15464e4b5b425999cfaeee1efd20ba0c2faa0cfe7
SHA256794fc2843aa54b3725a2237f13c57171f3d5aa07a0a6d743d2e123986b44e8d6
SHA512bc6b41e4e124958d5939b2fd8e8a89cbac7ba985cfabd8712f8dfcfb68688044b4e61ea6977dde055ca8605a69fc2e584166dc8c6915a1ec4865e604c64c996e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5d1efbfc5da643a920d96e3953e7f13
SHA158edca5dae4307a334890ff39ac19171ade3bb69
SHA2567906b813bc7c197e15ae680a2ac091edffb6ed0872ada8bc5ed8f1a007d17cf4
SHA512851237bfc182c543d6de9c63f159f4cf53986a8178bc11e3f47feecc09a8ad0fff4bd07db97f6d20e6e3a0abc9b4bef7fa0780940e15ae25dd9821a3cbbb52d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53985ba0afcddfcca0d91434de957f623
SHA1bee73246d7d2a9bfa793e83f4d994563c10b72a8
SHA256e7b7c8294a98fbd7607b53aef75fd3f6f788a9b059f1f3b57b9916b2fff6e02b
SHA512b7f95ad3f0eddca44f4f56009ab8d7ac95eeb72752ffb2370510502432588ec73b944c2ba1d3a289b83ecc8b890d670992f6390b2c8e990c8124733db9640952
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efe413fc73fbe567b3e0a05655912786
SHA1935ac11eca32b91470ec63407e768fa6fd9a938b
SHA2569882d8bb616d4c079125ac83ee3bdbeec32923ad1b855d7a39bbca6e1a82ac2a
SHA5123bcd5d27905f2a488f81af24868d8303d0004fab4dd2872848e0efdbcaff9c0d65a165abeb50f71295053809e96a99f0eb3e85755fd30eaf1ab6a457c041aef1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fb3c1d5e0a51381fcfbfe0d87d41487
SHA1e16799d3f4edbaff2edb5c005329b3b43bb69062
SHA2564b6a449627e38db86b4d6b5c2dcd0f080bc666424210e7b7553724c7e3dfbe2c
SHA51290708e705815e37be34bde3fc5840e4f24c9f68f8af4bbbdb0cb2a057067bafd18faa0fb7d228b0ea59290859a74a3c5d7717993b9ff1f4e3fd72ef37e9f6e27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a6a265ca975b102142a9e26ea765a2c
SHA17aa595d77d0a009bc4eac0562239ec3ea506563e
SHA256674353f4e541115a90e518331281b839450e7eae5582f6045c7d005291a9baec
SHA51207b8e21f50fcd3e890a9fff4c08ab481fb82976e78e937ab1f9da0117bcbd40c78e61c09422212c9927bbcc6027868cd275788ef9cdd4ce1a82c1674eb716154
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573c1ba8d27cd2808721aed5e985f7f3b
SHA1c31690bb10ebc39b92445a23c041a69eda4b9765
SHA256f40e7cb2a688a665e61d771f17c6a6fe35a7ee822fd8ce02469d8c524f06cc1c
SHA512629b96e0d2ca97af1a6ec83d6d24ab2f4d9a82d53716cad59eed833ec7563993559318f0bdb23692d617a8cc3dc31849a58511467380e7232bc802a1807a8531
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06