Analysis
-
max time kernel
140s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 19:42
Static task
static1
Behavioral task
behavioral1
Sample
51701991a538dcea97ed931e14f1efa5.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
51701991a538dcea97ed931e14f1efa5.html
Resource
win10v2004-20231215-en
General
-
Target
51701991a538dcea97ed931e14f1efa5.html
-
Size
36KB
-
MD5
51701991a538dcea97ed931e14f1efa5
-
SHA1
1a16fa6a13da07c1fc9c257f861f0cf4e8161dc0
-
SHA256
984d0f79e4b14d931103753c3ffb4e3f01b04c6b4b14cca6ded0f8b8e5aa34c3
-
SHA512
0b480fbede3b9b9883c339fc63c1041b476887bdd6660b274d52b122a07d25178af4c0f661b39f6ca7b15b9f73a74f8ebe8694aaac81cd084f59849e6368a30c
-
SSDEEP
768:z3pwjkAph0g4XbWJR4UhSImzZ85Jvwtvywh24/BKMIhwVY6QOxsI/MWQ9t+k0u1+:z5WkAKvhVBQOxsI/0Ek0QuqZG
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0456150fd43da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000007bc6579720488312d50c0a1efab9015dad4cd4e4fac58b91ac119bfd700d57fc000000000e8000000002000020000000fad2b9cca6d7a507d6cac203106f56300d2fe3a51952b9a094fc4c4e6ac8675c20000000bdac29197ac4d663479e86f35a79f69614a8a4f1f09ca3c676019e34b3de246a400000004e4e574d2d3806f870192da012a24914c13511b663fa6cb45f5df47079f487d0c5539f76a1e676ab784cda02381db7ad4000e7ede2cadc726d553232c393044f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000033948e59075efad44a4b21cbdf98103a9f401e1d24bf5d169a0ca4a31043374000000000e800000000200002000000071263794b8ea08894826fd436e3794cc2c47b2cd9af71debc08cebec76a99cf89000000061e2fe060b31823a311fc3b86a789b17f5265b06d252bd3f431e0cb7a4e19c5b945d3c28e70b9f6af820e2d24d9037dcc2ff9eaa200d6b0483c997e994ad59f8aab7b62f927ce2c62c3082f2a88f6702600ce050a01a2d76f1e461ed2d929456f5c39a5e8bfeeada8b7d1519db702200fcc2986a066d643dcd3a524a56a4184cfc2ca5d33ecec30d9a24646705e39731400000008b9d583bd52fa42743053d320f27d51a4a831cbdcd888014fcef6b28381fdd123f584f145a242fd9f9552f58904a3ef8c7d0ba0a63d285f1cc753775b6013c93 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7320BFD1-AFF0-11EE-A552-CEEF1DCBEAFA} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411077659" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2000 iexplore.exe 2000 iexplore.exe 1744 IEXPLORE.EXE 1744 IEXPLORE.EXE 1744 IEXPLORE.EXE 1744 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2000 wrote to memory of 1744 2000 iexplore.exe 28 PID 2000 wrote to memory of 1744 2000 iexplore.exe 28 PID 2000 wrote to memory of 1744 2000 iexplore.exe 28 PID 2000 wrote to memory of 1744 2000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\51701991a538dcea97ed931e14f1efa5.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da6a8b6bf3b243d9ef75c0070be07106
SHA18f1bebf1b458e5d22d2e8be803b4688d81a816e7
SHA2562918765fd9b9a90be8bd9059c2940614c841cd63d2e5fb7077a5f448ccfd87fe
SHA5122257320822b2b0f4d3271db2784e2aa2d9e5405d27ccec78dc547c64e245b7a9a7baa0395139085b44c76a95dc6f188d37ad33304136ace8971f5ac8adbe623d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a3fe45ba07f619f2354d496ab52627b
SHA181edc2df1f61ce265e86585f7c69f07bf2b887ab
SHA2567e39937b1c4080251147cac5df1ca9e87ca17f8fe8554365f88467bc08650ba6
SHA51255a9c8cd4fb2a288d1b92001e5adc0b5aaf438b217da718282821a1ec8041cb15181125b7f9cf8c7bb5f5ef806116ab409d74a5e4507b457db99b04c8e0d5c80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523b486edfc2bcc4e3ccf3b83f8406563
SHA17f56b7ed48369b6c90716d60d749a88a139975a4
SHA2567ef2663228ac858267ea6e73be31698e07b295708bea4391abeccca536c29a08
SHA5120c3ca35477ec89fe1a971b3b524665c6130246ef8932039f4683d99f223cd0d71f9f98bcdd506f854d41e562e9135a573140bad0a85785d1d3eb99784e79f4ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52609415eff92a36703567898333d7dda
SHA109bdaa03dc41a9a63db7f616eeb60a593443ff05
SHA256cbdad3df09bb6dba5f5164f171dec45b1e71ced02d3af43fa29c061b806869c6
SHA51215ec80f51e720a13bd5f21297ffe244279867316f911af827afca63dab375b19fe29f354685e9ddddd5077e81a3bdd474ae81391b04c0f3032d205f2851847b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce64694148abe90df6873cfa867187ea
SHA1db9a4f3c03f720bfe724688762d85ec4fb088f5b
SHA25654124d7f2769186c20f4136e8c557ba9163780f04b301e813a8771a5725a0f63
SHA5129f6feca2b6f81d69f29349a16d8e17a826b3868371caca4320559b4118bf44bf516f57f6d6bfb159cabca92ddfb5b39d84845e6c79fdbd1e01287d726462da25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5622a68cb010fa3167d8908a8502d40a1
SHA11bc5fc9bac25e26f840f03326fe4c5391e72f50e
SHA2566ae134ed0e856eae1774b2819f16cb57d233e54cb074010b971981e16b623e7d
SHA5128f54a186b85c63aa0fde43ed737454cdfe49bda969f438259e9bb469c1533247875c5e77a02a49743fb1f55a8a9dc2d01bb318efa7677d173bacd7d6bb9a7cd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c93b4bda4ef782cf584ebc9de75cf00b
SHA19328e2e60e192667c4e0a2a52b01aa7ef3c0f943
SHA2565180ceb1637390bbccf1a5acc63d53615386c2fd698b65d7b8ee3e21835b2088
SHA512a88b56ec9a920718f5cf3a0bfe3cc25d88ccab5f55c0aa3fbbd489522e1cac687bfc0b8ab707d6759af54f4660bbd2560552641d72409d59f4fab1aa3a918797
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A89I98IL\platform_gapi.iframes.style.common[1].js
Filesize56KB
MD5f6140cf2e81a9d5b9bc96970fe1946f6
SHA1e18cb20a08d0c13d44b72e36e9560aec2187abce
SHA25668cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5
SHA5121f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\cb=gapi[1].js
Filesize133KB
MD5288c5ba5b7001fe841c32f690f62cc93
SHA129aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789
SHA256c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52
SHA512e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06