Analysis
-
max time kernel
121s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 04:32
Static task
static1
Behavioral task
behavioral1
Sample
480950c463fa215fe9c6bb485b3a3d75.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
480950c463fa215fe9c6bb485b3a3d75.html
Resource
win10v2004-20231215-en
General
-
Target
480950c463fa215fe9c6bb485b3a3d75.html
-
Size
2KB
-
MD5
480950c463fa215fe9c6bb485b3a3d75
-
SHA1
b7467ae013249d0bbf8fe3cbef0415ca153d102c
-
SHA256
c483aed2487ebd8eddd5696dd7ead0be53e887777049328c8d950443d01ecc96
-
SHA512
ea68a2365eda0d1b3309d43d5c5550f2a65487f463779139c809c7c4895f1cf53b0ecc266b2621183b03a0fffe4d51dffb73251c1ddf81454d94046924abfef7
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0f7a0912241da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410763811" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000a595fd653d0e1025112c07b416525d61be35da006a36483ee5e28903d6ce2d45000000000e8000000002000020000000f618e4e3ee8abcdc1ad06319192a5b5542a605ba16bdee7814067398b605e08b90000000142a6bfad563294bbc1f4df7a9cfb00b2f3001092e6d3d46c9bb33b966369c903dcb52e32406d9aa15c4518eaf2c25dc58bddc56c76b43681c06dd7b74e9508ca1549c7c7f54b0e5eef780cd91dfb1aca501004c10b649be11ef2507e93cd5c94b1df8ca2c780e185381902149f4efb228ed2c1db7489563263a98006c65975c4d9f15d6a2224b40139b695a875e16a940000000797d63a152cb62cfa9a05a2464690363f0b02707ecef9b371b7d54009cad09a8b9a8a35fb2880e7f540394bb7b2cdee80a4f19441240d30bd03b654f0e533ec2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD16CA91-AD15-11EE-A5DE-CE253106968E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b6e27469516d57d0eecc7367628964a2f812e40db32fc339273c3959d44b3a85000000000e8000000002000020000000aa3306012158769220b8042f2889681311d5474b5d51b10ad688fd79c202534b200000002df9b737f988985760cf0f48816fd0a624a2326f3d985875ec4165a26bc820b640000000dba53c83995f2bb27a5188b19fdc8fb328ac070156a246d01708bc8e59406b8083fbb97f883739f37b0b2c85801725ebfeb78271a7648c4590af0b9c5452e03b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1664 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1664 iexplore.exe 1664 iexplore.exe 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE 2488 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2488 1664 iexplore.exe 28 PID 1664 wrote to memory of 2488 1664 iexplore.exe 28 PID 1664 wrote to memory of 2488 1664 iexplore.exe 28 PID 1664 wrote to memory of 2488 1664 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\480950c463fa215fe9c6bb485b3a3d75.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5808966a93e259de448be14311ac41c7d
SHA179bd9b82ebd242b86b1e3291044c75d029053f7f
SHA2566357c8338205169da4c287382b20fa54428277dc859f0a8780f772074a2feb60
SHA51258f8c7435956456b9edbdc4a74edf02743b751816d6be099b2547f07e2f392435aaf9342842b416ff8d194f1b8c6c1c45bb33f6248ed185f9fb4807fd2e3adcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55810550904fd494bf6a23c9224d8bc31
SHA1e99ab343e69d3c238b6e9cc6ccd5ba6878fb53c7
SHA2560eabda4d4d863938ce71f35a2cf652be1e3816fd3657731041fee401030f5053
SHA51252cb42adbde1a8b6d83659f6c414ca5bbe2a355b10ea89f27b74ffd743442d94d6cbf7aa8f928793d70b77dadb5d5416749930924d835bda461360ae63d241eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9ccc1f7cef1a96ef6fce9f15fbafbee
SHA12ebb0e5699233056118a69abbf53fb60edee90dc
SHA25670bf754732934f1a00ea1dd34e129a6c2d4d00c448e3ac44c4b07ffaa53e04ff
SHA51220b51d6da869c1532b56878418f2c7d0ed504fa022759e9e1b389ff52a410ad0d36ad0e03c0da4d45c2ae371e2a3027b7acff29704800c591a5d7be7a0a44736
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f7daa17852e5fa4729193e35d98c9d0
SHA1a148bab4b949e88e054fbb248a8a8cfe45d1db1f
SHA2569fcd74f74c753932ba47c18018bbb46891e8017f7387d14171c8e1aa8f5140cc
SHA512289c74ed5b5c0a211b7d597d8e99fc6359aa4bfb3d474ded06b8a1994655f63bc3a93b69d349f15d365724ea62e357422c0e379e214badfbd0accc7be9d97c97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb35f1d581459f5a9fc483a4570a1efc
SHA1730624f02542208510cd462c190af100a300af82
SHA256150be3d7187652232afc5d8e3efd97eda462addaf90011531c4fa2c6757ef812
SHA5123549fa697e48de20c300fa895ca1bf54f9e289e08392a2d4dff4520382d086f7df6bc323b9e0a692167e48c4203f86685e2950bb9946e4f95e21aa1cd5e752c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59028d19faab3c1cee47a32f50bbce51c
SHA17b4d92ed125be68f7ed79c90443bfe2b8862d7ec
SHA256f0ccc793be61c9e2a50d76f1ba3756ba5eab34b8b6e152a53646b3f5678f560a
SHA512241f43a4cd3682598869f76efc20dfcac0e5955102f897bf96e271268ee18ad490cf8a8bbd2793be0f3a67114e6fd8b9d83db059b93fdd7804f3cfd0fbd5f7d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58267de700941eb56a0bfd5f5f133b826
SHA1a1ab6c47776a98103e66e7543b4f19334d555ee5
SHA25685aea24dcce09836a8f8b1033b7abbc18fb008f8e6e29b2918bb11342e5a3321
SHA5123895b6b28b28e4cfa5cc64c44a7be7bec37f5b01dae0ad48b9a4e48a9eb875b221d4efda4e8e02c9fbed3c8b29f517d9ed1ee73ee7c098801a85c615e9e0ee73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd1bc0b82cc4a941278db8c81f3d0023
SHA16cf480fcf13bad79fe547514cb4651676b956c34
SHA256d059d5d4d25987a505d32034c86471847c44a8286c7c1df4412869fd60b702ea
SHA51285076faae0f6d810569ce184e89df953ffe83de41125a947c2edc4ed3c41b28b47d6778ee57d1d08ec06a190d4dd70bd0ad20b9c9d82a8947e415c1d3dc11e10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4107ca006154b468b1a29279f5f84cf
SHA137cdd349e779c3d57ce5ee59aef58202f16c9bc8
SHA256feda3fcc721ac4068cc77db12aa5ed8cc6aecaf45c35c7ca2e1bd8b78d48fb3d
SHA512ba3173951930d96ac87b1c75e51534338918e1a7e543568656c6694e6404cc2665f9bfe3a7c8abbf3d8b402925f49a9f03c7867e2269c3b3f3f948e2a7458947
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a08c813dd0740672d9651357d0d1b8f7
SHA1d1c3b5952e1d24297ff82690cf19ef64b9d2f905
SHA2563d8b5511b065114f35e14c3a9fe6db449c4a2d181f2f868b55c2dd364fab994f
SHA512af64561e5669564102a9573d5c646b989a0c601bab50f6073585c2652523e73fea99284818c7b2cc37461bb11e294f3f3dfe7d273e416fe0b079e360c0b9c702
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06