Analysis
-
max time kernel
118s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
09/01/2024, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
4f015ce559bdf0e29bdf653bac0ff3d7.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4f015ce559bdf0e29bdf653bac0ff3d7.html
Resource
win10v2004-20231215-en
General
-
Target
4f015ce559bdf0e29bdf653bac0ff3d7.html
-
Size
29KB
-
MD5
4f015ce559bdf0e29bdf653bac0ff3d7
-
SHA1
2ed247fc0443c7855572fbefe1bf050f75b5c4a0
-
SHA256
886c0c1b41be81048caa5f4fd26b092c12ec69f8f7639fe4f78fbacf68882b42
-
SHA512
fc3ee27c281b880a45df9922e7e5b10b502249876e0b39b5eb022d201015959f5068407076eab4a996f0dc7ff025b5aa360da971d1ff38fd73609e109ca517aa
-
SSDEEP
768:j2aTpI8Pdr1mjXAt4RVHN/YW8p9O1oKs5EKjVudI9e:j2aTpI8Pdr1mjXAtGViW8z8KWI9e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B6BC911-AF24-11EE-A371-5E688C03EF37} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d564e029674266599e3ba509957f05e78ffe3238e7f820bb8aa56166ac7674ed000000000e8000000002000020000000ffaedd75739a390b631248a27f5fb122855a1caff9ca80edb56822b44a72a6bf2000000023fc5fa9d6787cbc77ca7a4b412b3ea9c41b6af3f4a0ade16b91caeb352b2d104000000033ece97bf7d6347d2b031edbc5adf846f0b11fdb49f01afe01ab5329fc93abad5f5a6f4126e87ca9aa56c17ad0c08c7e993110a87f4d7634d78db596bd9510ac iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00bc8c3e3143da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410989993" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000012bdfa7717907975a3086be708f16844fe31651fc791c2af88108c2305cd895b000000000e8000000002000020000000227127e7cf6ac784a760d036d0a2a76e7a8de75af10fdbf647b2c53ad12ef441900000002fb2aa8da05d42e51abc5bea502833e051c4351a603421fefc3fa60ce2c9331ab196461157196a7818804c5911dbcf862242d38026d71cc3c53b486c8ec6b274773df3ce98e63cd6ff6ccc7143846805bf38463412d01c9383ca045ec41fc588ec0026a00b8bd87822605bd27cbf699333872b3acada04085cf9de6ec0572a693ad9f67875a85024f974caf4127d5c02400000003391eab8129e8c96604439fffb040f0b58e0bd69856a9ff2f4b4bf97b72460c0ab74c22c5242005f7bccfffe850cd4f550c27170f8e246ee10ea0b58c51e9f35 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2448 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2448 iexplore.exe 2448 iexplore.exe 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE 2748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2748 2448 iexplore.exe 28 PID 2448 wrote to memory of 2748 2448 iexplore.exe 28 PID 2448 wrote to memory of 2748 2448 iexplore.exe 28 PID 2448 wrote to memory of 2748 2448 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4f015ce559bdf0e29bdf653bac0ff3d7.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54146a3e8751e4afd6de8f06981f58324
SHA10533b4776530cb33b0cb35206d8c18a24f3d72bd
SHA256691288e151fb772d6e2785c3ed97617e61ea5c2d74dd2e65b06883b0322b0c8b
SHA512f13fa1d1b487337d6d959fe0be3960e9866bd70e9cc074c5b1355798ac92c6d68ad38b37854d8271f4d55c8792a044089ab3694aa88e3de705693a08a5a5aae6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5046fab3863cfd5d30c45b5f5ecdf73b0
SHA1130b796abcfa03c4ecbb072d4c26369f9e23bcd4
SHA2566548b0db68f0e3ff0f143e117916c17fa8b3e9679973947f0f93b59e9677fdbd
SHA512b4785fedd985a055713b54d057da1a2d0120b88bb834ba6b76d107308c43bf6b168b4fce051635ba87992da344de31524a7e1311f19b6882d8f9b344b5a78a1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530f1df5c2da9c92747f0c2bc7e65b650
SHA11828b6a0aa1f7e68c0963d778e3e502b6351ac7d
SHA2563f203e68947a728da4f472ed32626d3ec9cf372f019f2a551f6e00a28a8c5a7d
SHA51241a9829d7330e7e6b9c48513c3a0c6b153ef4d58f7d00721744581a618d1e6b0c9fe498fbab9a525fce80b728410527a12c2dcb61e30e155baa39b5f4c41f0f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5566bda87ed7b7f0ce49614352b53fc1d
SHA116f20fc2a1ed01f5f6d9706bf9e68cb65e81c7aa
SHA256a8d841f9abef4bc3963722516a3f7e3c39237cb13db4402cbe9c695844c7c387
SHA51295cc03c267524f7093e5db40b55b02fe109d91209ff35b41c31da0add861c826c5d54bd643de6b7b9fa9c6b66e7674ac0394f1b02b2b1dc5363bedbca6093d4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c0b2442c777774102e42ccc6f85f0b1
SHA1f1a09d0929048f6b2ca07aedf72b30dcb2e4da1d
SHA25693d9e1f9205a92d669dc80e4493d6042b573166044df879cf55b4c230261389a
SHA5126cb116ecc667a14cf431b3a70e3d22ce12aaa5ab2916c9af110308a1fcd8489ee708c8d046b4adb2c51b66b0e25ac9c2d30b9d63794d4ee43533f8eaad03d063
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da2dd87b45007d83736b82b2ab0aacfd
SHA1d3112dd85637cce494f9a4cb4a5694d2e64d37a6
SHA256dd90530864dbe3bc8f18fe24d7184ec75a3e1697fb50a20b955dae122d0dc701
SHA5126f16169eb3332dc0045b9ea99b160b767c9e72e9e0ce58e2eaa9ca8edceff359b01f0251e1287f6f0777a35fac1d3f83a7429d0b4b3418909b10ba30d56eb883
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a35692fea28ee405df48b1c97811089
SHA15898ceb4f556147408d4e82f7633a23d64c39106
SHA256dafd656feec1b602ca25db625a2cf3a649d634dbc6ff04e31cd820eee3efaa73
SHA512db7f322dd7da40fc78b887226207222ee15e4e91d2f33b9951deaaa2c4b33d0e7b2920c004b02230b42697d9089281810100b1c9b493ab9cac34e6c6bdae7a90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b755e3e83e04460dcb97762d6b56b399
SHA11d0b135ae5918697811bc071329a1dc5627f613b
SHA256cb30d71cf056bb254cf716340535d8066879683530edb13fc96cc5ae39f6cb66
SHA512e36c31aeb5f7de17a7890256399eafc1ba87ec15138b348a75ef01bd29f745534a88c83eff711b6131ed56e76b58350cd3af0642fbcfbc1c266303b7ff1436db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b697f89d3ec8ede3abbcdd6779ea7b9e
SHA10636285758571da609c7a9eee9d7b6073deb03fb
SHA256254991986e56ffbd1f74448a38e016988f9622fd9054683f430199b23e79d97e
SHA512b4130e31504fe3efd47b92714ba888f7fd00708e961c7684f555a6d01e8c24a00ddb2d2a2444aceb2f486da3649a2bd1027370cb7b815a5cbf785af0d3677e46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c827be1b92845a7174bc56b7856b5648
SHA1d40ff8c919d7dc6505edb869b7412a45e9ea221b
SHA256ee1a865645a43cacd8e76e891fa8445928f2059074e5e3ace0cb85825b9efa15
SHA51271d451d35e45f809d49e553370726f9af8f397020d0298b6cbf565d06141499230409835eb698d8b8033e7240f83dff9ea8c567da69bf0d2f9f0ebf17eab4da6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595c68a659eaae736523fc4e9a7ce37ec
SHA1f326fbb28bf2f9fb7dfc1cd47a16b02dadf2cefd
SHA256a87a48bc3d9a230f59d96b86f09c0fd5e64293c716c01013352fb47422bbdecf
SHA51269527fea10022bf6cb45fe798e2e4bbe0f0a9da39ae38f3e8596956c1f3fdf5acbe947d84dc7d4f54c1b767a797f7968b645653841854e3c5184c36a6672113d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab171094f053f425b78d10b50c018933
SHA13831ab30676689db6d89e4c1a95328260fa685c0
SHA25616d30432247c2960a56e50ebe43f56acd1641b309a3eaf48b1ad2483ac7efdb5
SHA512a444948b0ef10dfdd0b068fe84f39683efec28059cd05da9a3805c0741d1d393fe20f8823d623d2d9cc5f1e654309a067d0286d64c7a6589dee410db12d499c9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06