Analysis
- max time kernel
141s - max time network
138s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
08/01/2024, 03:39
Static task
static1
Behavioral task
behavioral1
Sample
4a56e30e901011499ed5cc2fcdb9a90d.html
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a56e30e901011499ed5cc2fcdb9a90d.html
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 4a56e30e901011499ed5cc2fcdb9a90d.html
- Size 30KB
- Sample240108-d7pb9abeb2
- SHA256 4d00e08647561353a96cbb3212a3afc32f72fad2cd9bfed946ce2d5bd81b71ab
- MD5 4a56e30e901011499ed5cc2fcdb9a90d
- SHA1 9b2444571028a73d5727c92244735e0d146020bf
- SHA512 5e2a056598b7172afb9b6add4d97d55bfebb0de6726ad6d50fae25ba07a83939434e50d560612bc6110bc6fbb5c8510ccde587a0f2a9a25586574c9d1bcc1bec
- SSDEEP 768:mQoiCHqmFievvhQxyjIKptw7ODDuF25k7hHJ5m:mQoiCKmFievvhQxyMKptUF25k7hHJ5m
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81B62D71-ADD7-11EE-B517-EED0D7A1BF98} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410847034" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e01ca9150f8d059adc830b67255a0703e7eee59139ec5b3ad74fcad7897307d7000000000e8000000002000020000000dac63e060b0089f680cefd3a535abd0b668ac973a54b5b9c1e8c640404f40fe0900000000fd984239b97a904630f8f168fb41d86f76ca9e24643fd58908fed04a3288aefde919e8faa6c372f842c851f556aa9a2e9393a44e3da2baef002d2df057232f07c2be5e0e388d6bf5a2b17da7939d4fc6eb3102ef64e5904b57258d31d93213ed17a2f03155da397847bac506aa6b03fbc275ed7f60dd5b7092afedc0ae2f34e1baaaf1cd592246e85998015405ab8b040000000f5dcdfb782734a4709fca3d4bf7abdf93db8e6b6f416a9fd93f5d4fa696d1ad52a4fd792aa37af872cf21e8b1289b5b02965671e16db76ee9cf822fb8678723e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 000e5374e441da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000006e6bb61a10888de07465b8874b461b21191cfa110c7f5efc8ced895427a3ee30000000000e80000000020000200000001dac32f4887da3e89604518df8ab5d16b357b13fcf7789f3602c09c659fc5ba620000000b30c6c4cd18e71358fa3ddfd275bcb10d1ccff1c82fd601caa7fcf03e5e927b140000000de9d3ac9842007d04c75e8253f984379bd5d028726fd6628c56611b936a2652dba4fc32abdacd7264c9c41e69232d6d36e01e0ffaad67a3f2cc206f676caf0d3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1748 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1748 iexplore.exe 1748 iexplore.exe 2708 IEXPLORE.EXE 2708 IEXPLORE.EXE 2708 IEXPLORE.EXE 2708 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1748 wrote to memory of 2708 1748 iexplore.exe 28 PID 1748 wrote to memory of 2708 1748 iexplore.exe 28 PID 1748 wrote to memory of 2708 1748 iexplore.exe 28 PID 1748 wrote to memory of 2708 1748 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a56e30e901011499ed5cc2fcdb9a90d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 861e093bc5741e854680f7bb14f8df47669bac0945d30700824c3ea847d7f2d7
- MD5 9a7d4881cfa64ac403096954bf0b708d
- SHA1 3d7f769a237dd6c0fcec3cbdd5672cccd0578041
- SHA512 275cc3c21243e17dc545115e5fd509eb09de870c4ff76abedca7a42be684a2bab731040372741016f6f4e13a178609112f06b8c26de6427f19f079d05c258292
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 9b3e5b47d89a9a9f00abc959c6b2166e326c4a14d66c115c9877a7e7275ac5a5
- MD5 3b255e2226009432236898f5674b93ed
- SHA1 e46b938cc80fec3dddd4fa18a68f17008b6387c9
- SHA512 4443eaf09d733f441ba1ffeb827d02707faa810852d82761049be3b099c0ff09924c17a38ca35388620e26217443fb6c8bb5e80b1e1581f6a258a32c23317a1b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 67a08430a0189f7b97a41feaf0d5b7e654fe51ea7111f3c03db7d8c590976834
- MD5 b0198d281bd17c94f99f09cb4ce967be
- SHA1 33d270a7e7e6c844586f635f00ed1a9c0ad1bd3b
- SHA512 f51b29efc54920faeb3c4d444814dbc2718faabbbc72173b2d05fd7add589ee8a569a8ebae85dccbf4c1166e080814a14abdaa5f5a36a3f391bf48c1cc141c27
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 6e97c8707003b8ffa0c376598e6a33143a53dc842653af3f55f7b2388af26a38
- MD5 85c17a5398b4f10b73920c46b9e9e3a0
- SHA1 c777a5a499a47e37eed47db9ab4bd9ba864b8e7c
- SHA512 76f0961a25fff1f828fc2985c0a941692233f03e378bdbbc3a1c445a8bc791c530347d4d68c876b07c1b4faa7f9a2aab9496d9d409eb358e889c32bf60f8a1cc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 da45f5bcccda84c932b737f3b18133e2619eb6f39976c677eb2b195fb3e1ed19
- MD5 be0e1a3041d238f41671f7a004b1d7f0
- SHA1 dc5c1d5047b7584a27d6c279ca6d414ca2def37c
- SHA512 b3355caa4f55c247aa90c52f127504f0b1e787da32a209297a7cfed896eeddcd0facf05aebadd04a4ee49337b95fcf0b08059ef7f1be90037fbf3692edb152f4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 a0c8d7a05dea61da50bfe0712fd21f1b35a956ac6fcabf620fdf99ce598a3c06
- MD5 aee2272948c5d4bc052a51360d7dd40c
- SHA1 b55bbd4de36fb7986a1cb21f0a565f4705d8c315
- SHA512 367840ae127a22d2c54cd9625d869ade831c448a281d8ce33d88eb2b43e076060a3bce5eea8ada846229bff7b0c7198fd480376bd6e319329bcaad18e17a5541
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 d5db4c5e8faeb169dfea489ce245baeb7c9cb65264cc15975f15f3a06a86ddc9
- MD5 32df36af16a94fa838f956117f97b191
- SHA1 1f37ee29395834bbbcaf773127371a8d21bacf8b
- SHA512 6d260f133e4723b2c575e110bc1f8326545758a54b41c8f0723cf4ea9634f18abd44e17b1123746b1e7fc75ffbad8ea9874a2faea1eb358a840f8899f94b5e43
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 d690b1ba8221b27f3b36c4bb1cac7a0fc5ad7d65873c125a1eaee1c800b7c621
- MD5 439a4c1c6f4b365cad7e00b8566310c7
- SHA1 2460be328c7d37ef9a5c89a91425f05e50c7e55a
- SHA512 1597d4df8fd326d8f662717aa8d347e0e6cc03baf071be8cf74c5c71475e00b8e642473df0f2e7f6712c25a1a182716c9a19b7c9b3a87e238f11c23a71a6840d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 b88cefad8e70b138cdc393a98a85ad2c01e89311dd14b0bc69c10212ce8aa7a5
- MD5 f11eb6ad118f53e148752d46d581e805
- SHA1 57605f9694eb66221c66a1e5646dc2d8fc1d126e
- SHA512 b989c041821a4c79502ae4fec16bb18e789739c909cd12bdbaa3d718af3d452a7bd7aa296266aea66829cf46d5d667250cb12d5d02921d3d60db99633d4fadd5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 e794e1065cfe343540dbb1b23abbf6c9b6bbe25adddb2afdbe0a71bb56003106
- MD5 132c2af9ef47aaec4c5d986398344b68
- SHA1 fac7540b6d19b15ecde109aaca7fbb290de68a94
- SHA512 ed365a59bd8ba6a50f5d9e9a19d8127bc46f2e43467778e4695534a960adf6dea35eb86c1241da84dd745437ac3917317ead7d2e11ff5d424f509861e1649689
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 c446a1daacf2b0a41d362b2b257772997e9d3ddbf183abcab614d0a372f207f8
- MD5 2ef859518b37ed63eebe63f9b5fa5d03
- SHA1 02b17d4c9b888e961fee5687b6befc35b6bafdf3
- SHA512 f6936f2f82ddf1cb95a74f023b3b2683f26cff4b0cd32a56650d3b0c7d0df2c25153201bd3f5d060d2fac04adfaf1a87f802d9692875965dd3a51c5b4c9bfa93
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 6167f17313d4607b44581c091614e43fbe66b48224d89d16c29f53793e2519ab
- MD5 2de20f8e9b90de711e78111d8125b8f7
- SHA1 3a6ea40f63d7178d0e2e3cc827c0ae62b0529fef
- SHA512 bc11b6cd8ecd992ce3f4727a7a08954214336c3f0728b12dffb8b068aceed49837b0269295d87f345bf8b3a1cafe8e83b39fdd8e67ec69435022e8b4c82a606d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 b98ffdb10b6131884b5b14b752e13843c64aa422f0cff3072ee5f89781afce78
- MD5 a0029e4a1a942a9b0d04eddb9e2def09
- SHA1 0aad5ff4165c2206160949b0e014f908115e83b8
- SHA512 12c5b8d28f43e5da5046fbfbdf7292570d386baafa4c14c3595577de68904fa6c431b86ae947b033116250d7b943c0840116238bae98c33e0b7f5d3966d85367
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 6382832a04eb9800eb6ec336d433c6f387a3a8368155e27bdbc8715d0fecf0e0
- MD5 469a9478ab899e154b50d5762322b85c
- SHA1 92e0ec5d21909e8fc14e8a0ae169c920393711e3
- SHA512 5acc1199908f8d62f697bed18f98e6ce6184b3d43304349fe3dcb372bbba101040af03250655a1224ce07a9e76d57919664ee8c1d0cf8e8b369848f5a97bcba1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\CabF4DC.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TarF55C.tmp
- Size 171KB
- SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
- MD5 9c0c641c06238516f27941aa1166d427
- SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
- SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
- SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
- MD5 SHA1 SHA512 SSDEEP