Analysis
-
max time kernel
121s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
08/01/2024, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
4b000167f307b2019616828e7a685861.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4b000167f307b2019616828e7a685861.html
Resource
win10v2004-20231222-en
General
-
Target
4b000167f307b2019616828e7a685861.html
-
Size
53KB
-
MD5
4b000167f307b2019616828e7a685861
-
SHA1
2fbc393d83b8cf438a6909f48f6b7dfb49444918
-
SHA256
e14f6fdcfe48b1d7a5c778752c65281b413692cfce12f1f5e4c729a0f7575972
-
SHA512
8318cc675d4f237ba37b4efa746db8a0a7da73ec6ae09ad0623ec7142695ac60644da0f3259afef7c021f6d1b886c56ca8555b4c3e07bfe59ebdac8d0bbbed9d
-
SSDEEP
1536:CkgUiIakTqGivi+PyUWrunlYg63Nj+q5VyvR0w2AzTICbbmoN/t9M/dNwIUTDmDn:CkgUiIakTqGivi+PyUWrunlYg63Nj+qB
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000034824bf14b2f8ff811a1038d19d419b67427fcdd8b9dc7d8c92a3cd736cefa34000000000e8000000002000020000000150a919c48f6941c8439cc853a9ae91c50a55be459cb099a95daef052fd609e720000000d532618d1dfe5c989f7ed6a82ee1ac24465c3abe9e1f35e24adc5f79351c576b4000000089e51f4c8960a1f2359610c3f5d2eaea385911b9df457ef7b152baa307030cc101b9d42261f277322b884a9d35abbd7dc7c92dfb6e42a14a9ba310a930638496 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000009b259ba6ad3f4437663b46dc58e39823387e80bd5ad1660a5151d58bc2cc2443000000000e800000000200002000000035adf7aa482bd7f061d571c768f0f3a3ad5150e74ed5529e6c642b0a7bfd985d90000000b206f0facea9b05f6f9e460ba19f3e328c383e0435c176d9f07468c73cf89718ea2c2e5cfd2ac45ae0cc99e443cc0c212a25693307edb97879cfb62bb6bd9c8c009028a61efbe700776e153c4239471b1443d13d488ba766af9822c0e4a43c64f92b0007d135a05e1db9540a6c9483c5060333a163b2bca422c40739a61bc700cabc0eb7a02a9de6c3fc90c3c12f4d0f40000000b2843576637d7c27471dcfa0309c3f83f348ac1f9284fac3918a17e26385a75b001320af0e80f7ded0e1996e1ed2cd1f2f1a42b8bf4243fa308c05bbccf68231 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410866189" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a08f500a1142da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D76E751-AE04-11EE-8575-62DD1C0ECF51} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2664 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2664 iexplore.exe 2664 iexplore.exe 2840 IEXPLORE.EXE 2840 IEXPLORE.EXE 2840 IEXPLORE.EXE 2840 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2840 2664 iexplore.exe 28 PID 2664 wrote to memory of 2840 2664 iexplore.exe 28 PID 2664 wrote to memory of 2840 2664 iexplore.exe 28 PID 2664 wrote to memory of 2840 2664 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b000167f307b2019616828e7a685861.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6cef4d5ae1e501220f3678a52e6f010
SHA1e23bb4191c33793001801c537dafaacae093903b
SHA256647ec8ad5103a49f752dca475af16ce31a65545c3f2eb1bc4925fe176845c4be
SHA5120798c83050f75d19a202ed3cc26a2ee0063e0a294121ef99d32cb2e078df3e4bfaabd649fded634c6df370315580ec511ccdf516bd347040ed1c1fb1c7051c00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58587454cc85aa3a90067f1a431835524
SHA17d62a4a99b74d1c91af9562c0a18538d8a9f90b9
SHA25636dcdf692dcf21236f7ee3d06298cf2852ac12abafed55ec2fabe3a7ae4c19f1
SHA5127707c29cefe34e8fc154d3746e75794b50e43a332350ae665b29fb0798a78ac1f98b302478904f427a665d4a7964245c664bd4bfe5d09614fa0b52ca6069d73c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5204112a9b0a612220a809c14c9785f19
SHA1c149a92e74a678d89f4a518b14980cbe3934fc56
SHA2567a50d026f0f32cb544ea75b74e9c8449571fbb60ebaeda9bc2495839198bc8f0
SHA512e2455f00bf815e9cf0fd9506483afdb19ed6b1fe447260966b203b99ecd5e2db09743b3d5366b63bda1dbea1230ef3fbfe87fc6851da90951a8ee533b362aa83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1f65404d9baf65742094aa7603e7fca
SHA16dc332266a745f367e15acfe66c75ee558c52ab3
SHA256e777bf7334eb6680eae0ac50060d3a0550ebd84a002e464f7b5e7c1c6d00c301
SHA512037266f00e5f784dc6a59b8dcc46020692cbd761fbf682f4a81dabdd1b03c10e9d698c7d7e8ed9e09d76bd85c4531e8214d6987478b379e33cd716d38b9c7b16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5049395eb477fc6957eeb62ac161959dc
SHA1eb69b2749a93a1080538d11964229dd991e11345
SHA25606311cd4b511ac82ee3b4e22ee70922de5d80897e59051151327966bebee3773
SHA5123039f2ef95dc461b83c2c1afccdddd052058ebdc85988697643e4433c266b2ce7b6102e5a81b1cb018b4e850bb7c1b8babef5367009fb4a2f78552b223df4a01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523045fa718fc85a2936f9d8419d55dae
SHA12d3b1ec2fd1ff1dd18d308d31383c5eec1572f94
SHA2561231b262078e3fb7a1cdf61b474560933f14c4781df7f2573404700720c656e8
SHA51209c3c2096398c3bfb740140e324d8d059c78c7a3b8826bc7d0ec23d36e281ad51370f36c5d46a57e219237ca9df366370959255ea455a293698134d86d22934b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3257ae20edfce556e1055acbc3b9013
SHA1beee1c0d07fc78f32e6848bafe407b985530986a
SHA256e031785af5cc38fca85d2ce82068670b008793354b7b27f07d0f37b20ebfdb26
SHA512fa435889386ed3f63ed30e5e7aa7ce48f4dc43fed732b5462dcc4afa3fdef4ec87f2d274d26282e41d47fc1e90001a00ee8f7cc03199e42ef166576df9fca7fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587d82afaf5a97494d482bc97cc8d506f
SHA1d44b9be335d09ff04b5d965511f07a85cd827476
SHA2568431f56a3dd3cbbac5336eb352f9e4430c565025daff41ec352a626e430a764a
SHA512dc97829e9a12864031915e38e726c24b5faf4e6ac9dfca6e9db185cb000ca80f49ce37f3e09b7fba95a292c38f370a7d237ef3e76519956ac84d45e663ec3888
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5538081c8dd1e795ddf003a40a920393f
SHA1575bb84b9233fbf9b85226495178392476d0944a
SHA25632ccb0aae4e4b12d83b17bdc646987f4c6bec02a64e39f1f295dfec651415cb5
SHA51279c95ffcf4543f4913306a3726e63eff318572c435a178967372ac81c35ef2a5da632fd001ee74b582599f865703aca393fbdee131c60e357b47291b19b3ab6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5292eb0641b514cee1b41fe94b0f28ae0
SHA131c99e92147692021e50e98457783d870935eaa0
SHA256a4b6a808f9177ad3bf2a94be60afa863f098111d9362d0ea1457d9a8f04a9f97
SHA5120348fc0140462b130381750c0936fe723085ca1dc32ebee6dbc7aa5dcb520d05634d1f2aea0a3905341170ed3e1343154758f341083fb88a65aedd87d9127c97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5399d81b4e60dd30c24d6e744ffe114d4
SHA198df5ed45b23c8a0ef0e189c4ae0075e05c85a8d
SHA256d1878e07c85d5ddbc7d84d58ee1fa2beb486b778881bd4aa20fbec111bf9819f
SHA51278ccabdd897563d8e0e99ecec11564fa8fd16d6f6746d562e8e55188f50e16366736f2abe2bc8f300745dce1618da5f84680ab9049852b895f257f381d019330
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55492bddddccc17baa65444731cd09643
SHA116089f36b33a7a73245306d376886bf15e3b7a8c
SHA256c62992779b989ea0aa6137a3f95be68ef1f53bef9101022c9baf08c39491bd71
SHA51258d2fd33e2a12f259b3b1cb69b9e85d56785ae0fb5ceae132232be006efaa805139da77443618f34adbd5c6c3646e59441c5bcdc2d3a16630b596b1baf426c68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a0050556d6eae414e1a6494847333d2
SHA138e86a8b1b121a9ccf6fe520dcc3dd1543c4db01
SHA256ba0b0abaf1d83b9eddd0b37ccc53b5dde141804cb08e2f816f57107cacba947f
SHA5128e37ab535494fc47b10d153345e7f82222801cb92137e95b76deb5be4933a36df382f2ed0fcb1556fbc119da3749041bbe4f31cf1878e44b88508a617646e4bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550aeb9a489c9e1565dcc13c24ca8ffa5
SHA10e0099ef84df0e5a19b46bc8c469317fe50c06eb
SHA256ed30c59f13a6b93201cfc09003b433818199157c535dc41b875855b7ca4e0a6a
SHA512b1ecfe4a6ddbda645574826573c606871bf85fac7b037014e4c1bbc819b27f9a9bddd1922ff648c2a872c23d7c7decc48399ef7c96db22842a72485ae99fa00a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523df7670773001eba01df6691698c515
SHA1e749032371e8b7ec1d3142c7de388f5773d6a5f3
SHA256308e3110820db827ad796d90ff0b026b4b6f182902368fd1141ae4551c250011
SHA512a5612b64a7561bf5116df23537de79510ee4a9fa5836e120b699981701b974a3b36f4253a07dface601f7b57b026795baf9ebb21ed573b12fb92e4593f9ef134
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557fe2308d2fb4474fdb33a0eb6c25ed3
SHA164ea493751708efe6e442719092ea8709fb1f724
SHA25675878f8101f91bb665fca54aa109c1cbf0c73ff6bd9cf1f82de2c4cf129713b0
SHA512feb39953f7d6f151d9b147aa8d8d4bf0407a8111f82779eb3d879cb8cfc4678c7a9fd499c46bebb06319c8f11390f6ad19a0f3dcc72e4d12991583e147780adb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1b6968e330c358fb8caba4be7bdd1e2
SHA139c13c740870e0f7c55320d4c5bc493d1dc57175
SHA25632533348f1c1cd69818c2e9966f7b48a1d3ecc87120e819a5e44f4ee5c396515
SHA512e3e5eaf3cb33a0b47f643b0ae1c7ac39493473a7edad26645a37ece58bad894b4aae050fcd85f8b0ade8509dbeb63f88d971e8c9e1928cf87c02f2d0681fb4e0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTTGCPI6\sha1[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06