Analysis
-
max time kernel
2s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
472741547c8242005a074d74a18e5ea2.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
472741547c8242005a074d74a18e5ea2.html
Resource
win10v2004-20231215-en
General
-
Target
472741547c8242005a074d74a18e5ea2.html
-
Size
2KB
-
MD5
472741547c8242005a074d74a18e5ea2
-
SHA1
03a886c0b04b95006a244d19d6fb66c3da109865
-
SHA256
77ce740647d8f855faed89b08bacb1a83280f467e0e49b9ce4a8d71824dd112a
-
SHA512
76d905b6027da5ff27a4419692bd962164752e90cdc521e4440523fa919dd0295b2ce8effbe475bb51178bd1d1e506cd8a82d4e67e2ba35cb977ed92aa727a7a
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{921427B1-ACD5-11EE-9028-E6629DF8543F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 832 iexplore.exe 832 iexplore.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 832 wrote to memory of 2432 832 iexplore.exe 18 PID 832 wrote to memory of 2432 832 iexplore.exe 18 PID 832 wrote to memory of 2432 832 iexplore.exe 18 PID 832 wrote to memory of 2432 832 iexplore.exe 18
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\472741547c8242005a074d74a18e5ea2.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:275457 /prefetch:22⤵PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f33b649bbd8cf8e22a6688791794145c
SHA101b8e8dfa97a00f4d2bab38cfac3dcd42352b4ae
SHA25646e7cb7b4c7d10c4e03a032c0c9fae7dff9d8bbd74a5b1bf4e38905f027f3e6e
SHA51252399082e747fa0bb3de1e2c8a9be466873023b2c103339dcb6cf5234a0175366e48f10ad9640723536888b9a7aa50f6d7a0d36f4d953a09bdcfcc9fced578a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef7ec207d4d3d6b214ad1e6f104d2738
SHA123dd6828670547bf66a863e497d0714290bedd00
SHA2560af3ea5db39436a30430fe562cd17250fcff1da89cd390af78e504897c1fb77a
SHA512c36ab6ab9e390c0a40cd76a04f9597e2edee77e1b2b677226578ea4173df6cf6f844ef86d45506ac465973d4455df1cda8ced8b4eaa16c1a20e4f56e7b1b5a89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bf2a2bbd5847b8ae3cfc3b0494276eb
SHA16f944982d5a8e21885dc095d891ee4acec1c4935
SHA256fbce713831ecd0108ca755533e52724eeab73b2a78078d4bf033c08a0d4aded8
SHA512ef9bf8140138dca678da4c0d6141a6588c83296b7e22785ad44f71f9473ae90fbed4bc36e973fc605933d63626ed98047ba69d9fb5f9f8dd11c6c787df5f23d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54452198a9486325be2d7bbe7986d0bfe
SHA1b64e41831ad7238f7fca292fc40e486f0bda3c76
SHA256c67b913bfaea48fccc11ada6e9ee76328d44dac6fe2553e25b5becef9cfbaba9
SHA512d2234ed90e049779c0f4d474ec73fc49e8aad024ed2f1957cac26c97c601c50e363fd4fd7113ffc47a936637b91df7c99c4c196c67988ca14cb4a4cecded3bfd