Analysis
-
max time kernel
118s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 22:49
Static task
static1
Behavioral task
behavioral1
Sample
51d53e2a55c88d131aba904b3d75453c.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
51d53e2a55c88d131aba904b3d75453c.html
Resource
win10v2004-20231215-en
General
-
Target
51d53e2a55c88d131aba904b3d75453c.html
-
Size
69KB
-
MD5
51d53e2a55c88d131aba904b3d75453c
-
SHA1
30c3e023291497ef8b5552540cde9009b04e4faf
-
SHA256
8acb2d03538ccc0d659072881f8aa5cbd67709afd8f6b66dde495d517de31b00
-
SHA512
3fb76d079a085fa5e2acec8682b23ea3449709943c969d799fc8c83e30f81141df9f5e16c4e2a5e61f76b677306e100e9cebece842eb7ac4a9244f6421d6ba7c
-
SSDEEP
768:Uao+TgnAzKpGpohd65gCXiUlTOk6gYTLDMNFSXZKEOkh0erLPhL5OwkAnPXCNy9C:d8AzKpj+/TOrlnVZZRrSNRUC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411088845" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000f865e867c6549c8e085bbf2610c3be0493e59a85288b2a56a16cd42f629a4445000000000e8000000002000020000000d7e17bb02a1c826362355bb49f21b6656ca2aae0ced75e6c268311dc9372d4c22000000073f6f7ba19485be1616c4457f76128cf8a53f0918405d09d580a900e955cf104400000005b0c6378c76b3243dd01a1c290b342c6d22f9ae5cdf5573a1a29108a21a8b4507e0c3b5a958bba5243435797e64f9a22ec712d4cc1d5d1a12e95563154c023f1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{850E0C61-B00A-11EE-943A-F6BE0C79E4FA} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000009f6b978a521d4e5c5671996376341a743fdbac59ad8e98f8c50c2fd81e13a551000000000e8000000002000020000000ee1bf8da5392b1711047c7da7289a60fe545a95a73810011d393e1bb0c3ee58a900000001396031125ce6c0c19de7ab473aea55226fd1187855cb743a1b55ad3b4089f540404cde820fd79376d1eca7c4aae3dcc5eb904bf64963a20fa040d82f6e126a693cd01fbc608b50666e99ce0b814ee58df91b55f612d08a01315ac6f0f3c682619c6a570b4849f02940a85dc203c8eae80585d4868f08025f4ebdba8badf3475811c08a95baf1f9aac10962819f7764240000000c990406854dddc2e83dd7490b3061174f426b931dcb2559d69119067b33ef72bf8ff79bc64654ad822ed8a0ab7134a96856a2d38738c54e58a2688346b2b09bf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7078e45a1744da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3028 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3028 iexplore.exe 3028 iexplore.exe 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2812 3028 iexplore.exe 28 PID 3028 wrote to memory of 2812 3028 iexplore.exe 28 PID 3028 wrote to memory of 2812 3028 iexplore.exe 28 PID 3028 wrote to memory of 2812 3028 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\51d53e2a55c88d131aba904b3d75453c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2812
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae2ab8ce63ba8bb47d2304a92f0a4286
SHA15fa814159670faf82e00dfc46aa55e6922a549ea
SHA25629da04dd5ff3cd0af532daf376bcf58a6525e78988d26895f49120276e10ba9c
SHA5123a7a08d95e890d260df8b56871b90adeb19a5c128a8ddf6134daae738577802dc6ea1b631a5f01d61206d5a25317654f3e854a610cd15f69e616730e9f71982d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507bc6fdcfc28d56b64e255c297f1e58b
SHA1be45f08b457744bed138d286c4f42c4eb9934aaa
SHA256e74ca694098b241d2527503bc2c2c1bd51b98afb403e77991484c9c7a5785ea3
SHA512590445967475a4bbc5a75f224187943b9a589f0f78f2b7f713fd558feab9bff82d308548e578949f7fabd69754e269cae022bf4c7912cf558a674d396d14fe22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53642188d190e828e057d7f45595ab686
SHA14b829645ae85ce19160a42cc1556fd16f29cd619
SHA2561e75d1e0aa51fef759d2f1ebccc2e254757afdc93854f761ca742f1a7168a2ed
SHA512f3031acef6c20a15adc6bafb77bdb838ea180805710de975937384438c784dd83184cd9dda53694f3423f46376b7e9687aabe57ecc7c457d6b7277e898446e8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4715e76cc14c2e80f2ad44067b8cf15
SHA1322a82ac53a7e9e9e2a1d21c903a539cc3e4c925
SHA256476a4845720506734e2e80991f570eedfe05f16831791620e35e1734f8b48d00
SHA5121ba779f1dc8bc4edb3763865994f08a1c55ae2825697da61d21840d8a81b51db9605b48b883eb031aee51fcc48f281321470903958881c824b6c57b85c33a97f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee3ebccdc0e2f7863ef3f17fa815e8cf
SHA16d5c47968eb532c6ac182ee24e1249fb234f5781
SHA256ce1e0c08a723d032c8c1bfad024c53b9fa5ba5ba7b3ba7442552a65fc3d07b2f
SHA512354aa2afee2a7f1ea77c2e689066ec1aabd6273c8f6e10c1bcad93e8fe1be632c22cfb1284f098e7219cf70e54fd61c9ff34cfd7050025d742eb9c41652f2b1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56162a6fb1aafcbbd759061b3ec692b65
SHA13d95434a8a00d65cf61967a0b8948abf18526d2e
SHA25695b0e5b0a789f33655cf65cb77a49194c6f0948cf5a56b438168b400108064a0
SHA512a1863ae59af96ca0ebe5275de22f27bbc0829452c3d6af5acc15e0db40b7ade97162f5b5ebbd54f2f67a4183e8f7ac4afff389c24462a362da46df3a8db91885
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ca8a2854bffe18fa4b9d4d294204eb1
SHA150be2a7e0d235255e3c4f32c6abb835362db443f
SHA2567c1b976ce436e6c755fa7e39fb558bd0ed6624d5878e2052e267795db516c373
SHA512e1c3a60f7829ba02f5f044d1a7e7d1af60d958292e36438656d7ba412e292c9c64a5df8766b01a5231fc890f99d29fb296a66cbaad35dd0f5361ca685d41d9b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555261485f6667219e45313f8b8ac5b05
SHA13f1ba51665aaae4b48d5343118c6d1242068e50c
SHA25686f1dc607dd379e810a9161cf114320c5d0531ee4056b5d24b511ec9c16d2804
SHA512f5b2c8e69ca3e6fc42477cd9b1fe25f5346933924d126d2a87d7eb408386d649b26f47a546692458691e272079b3dd8c9cc7a9529483f9be123b7e01b6920ff6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8d9e0a5841c299e1f675a5fe64f028f
SHA157c8cbd714e4d2dccf2bb18401c64e3cc11cdcc5
SHA256b38e4dc75f7694f7b44b2a2d0e9db432055265176de111f776b8da788fdbba1a
SHA512063bf5434c1cbfc9d4e79f339a85ea2129538900ba6d4cb74f83280ce29a600e4ade13483165d228b84f88b37b9b1a7dc6a19517dfb033a06095c599e808b210
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c250315bfdc644c3ddfcd325c69d9609
SHA11110b65512f4f72af184d04162800e67538f41af
SHA25639fac3749b99c77c0e6e3b3c16dbc2762e9d3aaa132065987cc861419ed1d692
SHA5120ebdb3ae34b96aca5f85e05b79411f3b69874f9ddc6c3ccd3c4d2893514fb60fb395f55fdddb68d147cb113d9a67d407ccc3edeacd9b866be1794d23d5351d61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509cf458f057ffe96680ab40084ea28db
SHA12db275186c5a732da05c82bfc7cc8aeb81899d2d
SHA2569f1163cf52a16cea2d30a48322ee8a2290159357aec8bbc5d95237a8b00fd51c
SHA51281e22761ef8638cdce534e707a4c3cc5e9a4361754af4907fe1b87b6297a9dab49c2bf84e485e95ed663f8910c52c273d5e5b2fea10fbfc4f59f2170c4b00f3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b94f5fbb7d63b9006c564fee6702230
SHA12a543a2747c92cdc4e325f73eedb3af2da2823e7
SHA256a6b9f4db24f8b9fce37f1a7f89cccce5a407eab1caf9cb7d48036a4e413a190f
SHA51268a83bc5c6956f292b4ac993eb42b3305925cb2f4946ba00452033b9604e65ac77343a1cef97c7d0a956a9d9767191741dd1d09c40d56c380e6c83632d7129a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5401f5497d89a7409a097e8d97bca8391
SHA10d8fe8247a07df76dc9e69cd1e90b152ac2153a1
SHA256d4bc0f97726867a4dbddcf55b48e6b30bdd7e5734768cc1e8464c7af3539b571
SHA5123bd8ab924c8f4efa2b2bcc767d59f7596b98b71b5a6eb0d0e2685268fcfd923d714a848605cbe169405d454be57298e44253f4bdfd8253ce466bdc20966299ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6e5220fcbc8342d4230d5a49cbc95cc
SHA15b433807f2fde81068a33d43e4de7a1a8a88c0f8
SHA2569562a27f259beb4b3fddb577823b6d5388b3c16bf4b032e6266c7758dc057780
SHA5120ab05ad00258bc203bd60f70ad6227ab825366dc9e68d406c3474f8c5c626dc995e4673ea232b553157422ace5fb6511e85c8232220a265f2a31d743b605429d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c87c414b7c353c45d52099d5ac8afcd2
SHA136782fdd3837281480150a9eff52e1af6295bcd8
SHA25688054b50d0564f02bb86a8b5126017320eeb9b3bdafd29ee8b5422bc27570424
SHA51250aef9253afdd4c2c795108c8ffa96b1534c3649bef71a820589b94a19fee95b3c5658bdb4c7f599e896d2f016b3005d1f29d40bef167de06489a39efc782c03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546e985f672d0064de4405b9590b558fb
SHA19045df4977b46385d1298e68d767d7723a1a0589
SHA2565f8dfeb37eeb8acad8479924c1bcf8838771122cc0cdfe90e8a5fb8b3c8b6244
SHA5128d833d4cccd69ceb389cf9113e34ba98104cf651b902c2b4b84351ebf861e7978bba2a5296949e91997c9f284121d7a4a0ae26e53fe71d0c2e4d067224bf1f01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf2c27e06377d61ab0d5d099a322965e
SHA1107e676dd183b4b0d046f56dc01c9e953b23c5ca
SHA25684499bdcbb7b5b65c181b48fcca413c8427851cd6b493593e6f973dcb7dbed3e
SHA51220730648e8deec53ea19e5571e0d672922f0ba5e352838fc2c1cbf172ea13c37cf85abbd6688cd3e5cc9e4d39b36222068b94b002ce3431ba3e64fb506d0284e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bcf6571ddb1d9321185be2f92890a6c
SHA1e930d9741b930bc5d964b77220b524b341008336
SHA2569ebfa5effea6d590193bec68ba2e13a62e7cc7eb9fd5906959402cb577cd89a1
SHA512720c6abc0cad2cadca107ea0ba3309edde6b0ac15cb5d4929cb97b0834596420e3e626e84a1e1e31fc435c905f9afb5b08187a1d91007c78a82e852d81c09db7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587d6be0736090bbab906d05a8a14cb88
SHA15e892cfa08ab17db59c5f1bf17f7ec85dde32088
SHA256e1d484083001ea55dbdb1809279933b5d4f3ff5f57b213c2283be65ac4d4878d
SHA51224f5554c7c71d914faacfe8bea42b39f7913eb77429e1120784263e8a38bd4e123d286ac0bea1ddbbd74d129df3177484b8e24d37ab7110ccbb9fabef706b403
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06