Analysis
-
max time kernel
146s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
08-01-2024 10:27
Static task
static1
Behavioral task
behavioral1
Sample
4b3102d8bfd4ccff2a6aab0e625d33b7.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4b3102d8bfd4ccff2a6aab0e625d33b7.html
Resource
win10v2004-20231215-en
General
-
Target
4b3102d8bfd4ccff2a6aab0e625d33b7.html
-
Size
18KB
-
MD5
4b3102d8bfd4ccff2a6aab0e625d33b7
-
SHA1
aef4d4df21bfa87dd74d4db653c68fd9758abc17
-
SHA256
dd362f5d137881c88c9d5c9fe014f6e010a87ba83f4006d06a45c341ab6f7a3e
-
SHA512
986f8183449394163a22d51563cd23725b234ed0af2a2d6e09bdc547ed44ff2e2d97f3c3eb06acddd1802004a0641326935381c3ebe128546a9992705708c14b
-
SSDEEP
384:fJrdHHOLEo5jKQtkmv0YPJ8dlKhOuIq9d/S3E6iBtJ3wwA6+5rZg9Eu0XaMPGv1I:byKtsikQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a6657795d19e0035aa4c5bfa476805edcd935361390305b1a4d4da510827c962000000000e8000000002000020000000e6040fe2fdbf5da235425da550e4c35387ab7dccfceeaf941b23dcb8559a4748900000000a4df0d8552a2692008daf0b993b67bc382a00f0583d8027040d6fcb16d40cb7a2a1ceb8f5686569fa13a973ef6cb57b9a5b2832587ee41ee2a1dbe97fcfb91806e2da504cd1cc0ef0099bf3da5c2ec0b75049ae563cb36d8ec906639dca13aa0de6279c5be6288b659a0cc84cbf6cc28228550b2e41768db912f12df03190e48bc387855af32d2c724a032aec8617a740000000b6b15c9b25c86d35cd440ccc0ff5d51035bec218160e16519a0941c6891547f16f11b3c38d47b0a4d3e67cfb5ab128d27ba981927ee9335c250d8d45a3669152 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000073f7333c063dda6147accb575313e22ead4f8811817892ecea594cad4cf06797000000000e80000000020000200000002c8945917c1afbf2de5f03689cd04e565b5f834257d1d6fd73ada360af11451f2000000052961818b92213f3b661810c3f45a2c63a6911d9a137dfe0c00a68248ec822e040000000813f45a120160358fd880cdb4e221c3f4ce094b374bfeffd28fd7a5c5d10d08f6bd9547b17c54602ada3741eaf6300e25e8fdf79b6655c82d450e67ffd6d1a38 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ba367b1d42da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410871560" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{996029B1-AE10-11EE-9B21-FA7D6BB1EAA3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1948 iexplore.exe 1948 iexplore.exe 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE 2472 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 2472 1948 iexplore.exe 28 PID 1948 wrote to memory of 2472 1948 iexplore.exe 28 PID 1948 wrote to memory of 2472 1948 iexplore.exe 28 PID 1948 wrote to memory of 2472 1948 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4b3102d8bfd4ccff2a6aab0e625d33b7.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d561ccc9f7c3449cbef6e087b8711e46
SHA1c7c5e47d7b19b40b3a145077c5390246b9558494
SHA25683976d20e9a02ba435357f2e6012100ab4ee0933cd2ea6376eabdd649eda0620
SHA5124643d2a6f954130221ff8238ecb12763dbea404504dbe73b3e87a4f5131954cc1329f8a5ab61ebfbcdb2d032017fcb42561b6e8e7ecc3cf78d3534775965e615
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5fbc20e5f56f3843740b32198418b9c
SHA1f21392448fe8db2bd7239faa4f5bf01a897dc42f
SHA256c53b98c83546c1f3ca8c60a5959799209b50ca7612e3ec641972d2296831378c
SHA5125cb48239339426fd02c8abea0e941388f1a01f71f9149178a98be3313b786faaf8c62742c7342a65bafffe9f938032f3c4f6f13c4be93b4b8d702b77e11322e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afc6d8be4cf9342df4c4c5c9afb2d407
SHA10b79886d5a59dfd400c15ed13ec80f1b32119726
SHA2564477768e47916abf5b225a98622bc4f43c68d54b1946c57ddc3d63f4dd8d0553
SHA5126eb3a0b8b7e0fd73b6e32b3157fbfb4e335ac1c9b7d1441b554a972f5bee14770311c031811cec03c8d7f3a8aa195330b53ba1b497fef32cad9c20058e68cc8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53678fac9f5e2fef8b28cc79954bcb464
SHA1bf971e69e5fe57f712dc258f2db05233cdb90281
SHA2563ffb87f7fdde261ea93a3297e0cca6391da54d847b32781ea72d479af46435a7
SHA512849678f546a2a82e1aa9d916dedbc0fc6ebea5fe624cf936a09143235be9212143f3a8c423bb80310272b83e988455814f5991c465c4756c9e0b4752530c742d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5952b0588edff2f8efed9cac36c6474fc
SHA17274045cd58026ca2a7fe4f8804f03d2bae5d9eb
SHA256edcaf6c30f4d57e9a63681c4c22ce87830e5fa504d7103c9b9d460312f2edf7b
SHA5127cd05281efebd6dfd3b86487747c1a67328acac890f8a58b4a2c72611ecf17dc40d2795fad2c65a0fdddd9d5d8845e244bb3111faacb7bfbcbc17c19fedc922f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b63f288cc0b73ca6223de0455cf0a93e
SHA1e76a63ee5d4f8c365eb94f7db78cb39f4893e744
SHA256a145696a0c4685e0d7cb3dd4c453de890a61d06a9b0fc6f7d95e18e475c548c6
SHA512e8011502676acb3061bbfdcc7c48960545e35ef00a07e00b3ef5fb220073028a48a22aeb27d6e1a90a697347cee5d1017f4c577b5baa9a6473916f40e21311fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d14f7d6769eb43b981ef0d8601a56a8d
SHA16895a245217529cc517f0cd7e412e913036c8f32
SHA256c0791934d3950628b0000b1cea72e26c936f431265969c3368627a1d45793b69
SHA512d1e111406d42b53bb630f63a612fdfdec093fb94cd9bcfb1a8095641bd8fe21276096dde5a3d3d1da122679df5197522c2da8b40d5ae075925d12be92d64c7d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ad7c94cac8d5a0e8d748f6db33f21ff
SHA1675bd44dc2fdfe2058b0193543d722b759a50d64
SHA2565f0ac8e8a4ce90274e86fb6b508540a7fe47799404b4faabe625e75487af7cfc
SHA512d901bb857e4bc0f593b2757143472da2fb696accf1aa64f85ee8b1dcddacb1736d03b933124d6860139ba9d4eb983359603bab402aade70eeedef7fcffef1149
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513dc6763f2124aaa023336a9442fb827
SHA1b4e7c82758de340228ee5ceb3043d56c8f264cdc
SHA256397a947ceef8c63fb1e04d374f99d7fd18b6c5594ad953a4b58873ed385ed1bb
SHA512859edf3e3e2e2e7c2f4d2c34caed8ad2da86d3c0782d3fbce1de0bd2ecc524244e5f28f907480337ed383d84b62d977e29c0255882ea131d29a1e27308e2a722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58508606154787a3f38e5ad3adfdbf65d
SHA1838d32d01480f5ff13bedeafd5ea782db1a397c6
SHA256b4eed04c9d787a7abe6a16c08f0870d996837c50c16536449bda57b48d4738e1
SHA5126fef77d184abddcaf61fce3f96a6a547b2da6295b1a388f33431bb678d82810ad59150f4b7fe4b8ecb03444a9cd6076aa5402f574f63defb38be0308b6e507cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ebbf330e687b5863255c56b3b2456c3
SHA1e8e4145da18ad7f1639c3b3cb336c473e4023e13
SHA25622d5b616d90081de197b69581da3e0171c7e1b4ae8140df81c84fd8683bc10a8
SHA512da37495c95014f0f0d0474abea0da8c6e95f035b216ad12f1bf1fe3990924cee4b3c16aec4904011824a6858e4adf330d17ccaa87daa5d591d303360e689c8c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53030bc0edcc50eebaf959ff39df70f8b
SHA12d1fd4ee1f798a6911997a14003569d106b818f7
SHA256cf26a0bf98bde7657e224a504c7a29aaf2206ea39e6e9b0b29adfab8a52f3851
SHA512b78c5362dffa6f4c8a8c3563db463fe7f52afb41f89eda8b90e59d286c5e86293dbe7de2b1a6cacea2f90e8ccf457f3b3729ff5c567bad91f89d2f4aa33995f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc38704ad22ac3c64a53dd5a7ffb700b
SHA1428b87911af6639ec97697db90f6a0d99b80f83a
SHA25629e64bb7edb4487c79d983f574622bd60c0e28d145b4699e56f7da873d788f5e
SHA5120c6a739b0c7a9524fcca93662a97a313b345a7a4465eb14c7e1dc1daa2c828c2f9dcdcf9019d589e5a84a7ea0a995eb7d85dcb96e9f8e78e50bf4271a891c1c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c42bb22ef71c35b901f7a34cf84f24bf
SHA1032d90a9edc2261b4b9fd9e8963f8deaeb5af8bc
SHA2568ddab95e313e0d82fc906025866305bc059a1e715dd083564feca0bab4fb9a20
SHA51226b1ef35547567e3c368c98f657a1e524f4881952536ad5173140777a3eb4aab092000280553cd1036eda0272936b5bbaf43f004cede881f2d763d279405569b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ed5cf6cf73c455a94f693dbf2171327
SHA13d4e82635017479346dde3578f2a2175ab657762
SHA256caad210b0161821357c170aa0ea7e7a8bbee9f52ff93d02698e7bc25a0466d29
SHA512899ebd87b33aa2d28049343aca23a6967039135813f3c254925cdc0129c3fcfabed3eb9989212eddf10dab51fe5ac2c8b99b5d8bdc3ee62b873769b6b9e30e3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a64a35510d2562d1bf00eb478fa88fb2
SHA1f69115eceb40dedb6f7a29f76f07b6e8d980f265
SHA256244f3349265a83496ac63ad9967e851fdcaca3036ec2805fc1fc6f8cef28cb4e
SHA512a8e4185535156434afd0441c71c683deeb5fb188eebd48192a85674cf40a272176f31253ae4f27fd7c91b4aa750c43a63cd2a06d94ee1fea4c3dd327350aef9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc72cf8616d18e77bfc3d227dc180764
SHA148ae108cfd246a7693dfc41ef29bee7bb36836eb
SHA2562bbcc3fe970b7f5cc040456bd0db0be2335f4cba3a0aff394973a78991d001f1
SHA512274dc4e8189c11a8340dedf3273e4ec22e4e7f192d76fb9af0bbe574fdd5fc1b32c14ed9400be510b60bbc4d2a43382706f0366fcf4aee809b60da265b474e3f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06