Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 14:24
Static task
static1
Behavioral task
behavioral1
Sample
53c178fb0cb84b624a89a5be5f2c9a55.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
53c178fb0cb84b624a89a5be5f2c9a55.html
Resource
win10v2004-20231215-en
General
-
Target
53c178fb0cb84b624a89a5be5f2c9a55.html
-
Size
314KB
-
MD5
53c178fb0cb84b624a89a5be5f2c9a55
-
SHA1
abcc63cceee79a7ffd59ce6d05ae0f4fd8ab86b4
-
SHA256
bf3923565fe01354d4e3fc2c8fe2fb111daea6504416902f015eacb35098fc0d
-
SHA512
3cf52a91683ca355776ab4be452bbd6de1e37b1de9e9e78b0e1bd833eb9144ba857e8e187fe6f696d8925c32ca33bc619859b9a07f4b80d7b4838797901f7fe8
-
SSDEEP
3072:JJWwys5uBZg+WJhIczPdYA78jrz9SdSVkw5OTgGT8eF4dZQ/i/Hc+TIPQeXEJFf1:Gwy3QJhNJSWw2JT8QuZQKE+TI4eXE/p
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000dcc7aea5ec65fc65b554d0c2b2fdc6886de74750b2b522f916b951226e0da915000000000e800000000200002000000032c2e882597407a8094a8c2cf7712c7adab8e8cc6ab3c762739cd8453ebbfdf920000000dd9b774c0ba0dc29f8cae9fa6a3c10cff38f5000798b08b442dac0d95ab315d840000000904518d5a6bdef59fd6ade27a190e54fdbdef4472c0523ae6569fb006bde34dc50e378e17f306ed29ecfc74adf650ba673d8758012104a42f5ae488bfa247d4a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411144968" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c8b0fc9944da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2338E2C1-B08D-11EE-B59C-EE5B2FF970AA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000724b11031d07436da98e0b03903df1bf2fdd0bf25e8b8cd5b2ccb24a5824ba70000000000e8000000002000020000000f1538452c526462da7ceecc1919200928c709fd889033ac7b4dc308a8adeb9a29000000007a2e8bda95dfdbd47cd09e744bfb5a3cd16c37898e836d63543758feaef44a5feb805adbf351134cab29fff0363ecd40d9c93442758d1c2bea0a703c51306c7b2f072540fb5c57cf189c88f3e5913a950c17fe84530c9055aef87fdf79c578b49d75624923bb32ba2208d223d589e3591c3be5deac345bbf632033059a8be41022e0f6053323fa6c5f268b59ff5d66d40000000e4786c208bc5f8d39589bddbc9beea9eb8079fbf5bbbde2f51b6e4df05d26df5025cdec36a9ffd10293e12425768b508bfda8a3c0d7edc6d1f07a61be3807bd9 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2088 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2088 iexplore.exe 2088 iexplore.exe 1456 IEXPLORE.EXE 1456 IEXPLORE.EXE 1456 IEXPLORE.EXE 1456 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2088 wrote to memory of 1456 2088 iexplore.exe 24 PID 2088 wrote to memory of 1456 2088 iexplore.exe 24 PID 2088 wrote to memory of 1456 2088 iexplore.exe 24 PID 2088 wrote to memory of 1456 2088 iexplore.exe 24
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\53c178fb0cb84b624a89a5be5f2c9a55.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1456
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f0222a6e1e90b25c61967760a372dd9
SHA1200723a935b61f661a4e7fe24b0f197fb66e7769
SHA25666243e59b525dd1aaca206bd5099f714cbbef6c82147eb1e1034d2bec1aa2f07
SHA5124953257a7ac1a4d01b983e5f0a6f66fa879e3cbf7d6464ac63858d39662bb6026dd083858a802a8054c3cda803fa4a93e18026e7422217a65947c4105dbb3af1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583e8f762ef3442f51e0828034db23ef0
SHA14c7314fb3b2af718f661b97f0a3930308bc8747d
SHA2569192ce4aa65773632d202da471165f726891090fbb9fa73185bd60b564b9a2e7
SHA5122bb8e81e9f0c79f3c4cdc774ee6af94c891a9de4cdf150c6f5baff4ad6fc98bcec8d73dd924f2cb9fcdfdd9d176d12c7616bedb102359ad0dd72515af4e77b92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5105247c544e2610a562e88a3a631d2be
SHA1d25da469549d8ef5c18a4a2e56e34356d18a9053
SHA25649c2fc6231764452cf2c8ccdbec33eb942f6ee885e9f0b067a8ebf0cc9e07f6f
SHA5127e04614587ee65d7d8867a10de6d538d3c63bac1d0861d2b969e9ccae57a89696bffea3f5ffe3c59c951f2e7ee4197fb1352fde1506d23cb89e6c02da16c6c8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527056ba6f7d5b06343f06c020b4fb704
SHA1275a5c1694668f05ebb7443379e74d31c55ddc3d
SHA256048b585d750bcd1f8f3bd592b40dbe303134d01fe06106a2441850ab0a83f41a
SHA512d4ec467c480e06eec4a56f99c4f46b63f25bd04bd3f1783516a74b0665a8cb8437ef90724015caec6bede423907bd9c34668fb9b37067f6491fc9f74de26333f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e647371f5209edd2741a38c0a8c3f802
SHA13de603406aec44569ef0b8519d8c7dc497591b9b
SHA25632ebe23bd3c261f9308eaee2377b35be28dda8bb15a5f4bc02d40763c949826b
SHA5123e073e69cbede0710801193f86e0256fa4b4e955d821899c39ab3a9af32fa8a7cecb714772576816b1d5bc6ef3f629d77ed2a188bad9d959820ad67502adaf51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5fb6e9fd8fec3875a71b311611c15ef
SHA14c2434411536dd9a7f308a8034f1b2c1a5a6be22
SHA25620e2b80f2133d08eed96f384189b476858f7bbaefa401d21c835208c726d5b72
SHA5129086e1224cc061c4cacd37f71df36a934b642eb4a5e9377adb8bc410bb2d629ad71d5c0aae556573adb6f31e2074a527eb78f462169fa6f86444536c0f1ce81e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c3671a2873cda0e6d5626218846a648
SHA17f941dbf94cd1725d71afdd76ffd14c0ce7e18a1
SHA2562c99dd02d1bdfa7ba02dfc1109c5421ec339f772c78789ba90860dd3b3a99c74
SHA51272cefe9ec40f8a3e5d21a22d7d1e4efb1077e8e04c520ad4999237e184ae5a6bbd5b992b3fda8487c29604d2e22835c423aed28cdc3192dcc5af382709fc0a02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b140fdf325d39b59cf8d18ab1160959
SHA1a9e36ccd9a1f53fbbaab211bcd5be4bc49e65687
SHA25645333fa56d5de22f349c2646879e5e212ebbb244d856110af2bd2a75c3b8898b
SHA5129d10578993dfebd815763f5b87a38b574060cf570a5221caf58e7fd3dcbbf0a1bc57acdfc4b57621439b1b48b16b3b5094443a033b7bbd6c688ef64115cdcd11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdcb59b622c8640c6d4b864bcd3e0611
SHA14cef281111c3367d24a902a0e3561305042a097f
SHA25665bf01ad23354728fdc01730f5aa907e69aae049e5fab8ec3fea10b8c55aa2af
SHA512c0d3862aebe7a03d9d7c85e73c8e6deb5ebc27a55914a03776855c48367c374f443b0c9e1dc1911842bbc247114d258392d2a48d6746c096f0a1502b9d96f6e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55274fd3f65e3d46dbc09bbc9aab36d2e
SHA132318ebf0e1dda00aa38f2981af1adae98d38811
SHA256345a3a23441cbd98aae49fb89f714e5f19706dcd8194660d3a5e0894ad5b4f49
SHA5123cb33da77f26a09eb933b95b6e809a67dfad48a43fc772bb99e1bfd51633c670d020590b7d0f4e4ed3f38d9e18873512fa826db4ce178ee46ee06d15e2a07bda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59419356351c180885b0cc9ce913bcd60
SHA10ee6bcf57b5e088c524fcc673021a1af772ff5b3
SHA256105bd4fbcd7f0d1756dacee48573e2e2665bcfbc89d80ea024ef71cee2ed4677
SHA5128fb7c61857e8486af96a3b9dd2d18c0a458171adb873f3ec79108767304a7fa8a644366026da13e19b9603a21c4fdf5e219b7f08dac7a6d0a8ab5054a60abe40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554b987c8fb1834707885b811c1d62bc6
SHA117f28a2bb0c383727d464f85939cce2c4f403111
SHA256fd45184f859e4fc6052a2350e87c17ef84904b1b98fa1fe39943c119a555add4
SHA512096fdbf74d5ad7964b1c9f60b085293cf0cb9309aa429bd1069127b8d7932a222bf59ba78b5a74515136dea118dc5f4810a3d1af275bc9feff3f4a11c623d494
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52046390ffae7224c117a7070a5871b01
SHA1f8f359e8c40e7f2f97fb71a2144a66ff951d7167
SHA25629444c997359f814af60f2e7bd2d5acbe4e3da9737814923ee50060f0d775781
SHA5125f90b49512f10fac0c2a8a4e7710036d41122b057454fd971fd20fde6decdde96d79c693800d147b3a9900eaa3b8b2b9300735e5b6eb29a10198568f76c3e320
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59faa86a07065bff568cc3672f7afd28b
SHA1316c42313bf95e26710ac66da7d2165246af2e82
SHA256cd407c88620eaaf48703ff1279db2cb43b64d8284bdfcc354fdf3076b537bfff
SHA512f0c099c89383473d6456d34eaff5145d677dca52022158307f5dcf1ed486720a0d7dfdc5f75ab8140cb45292c0312f453d065cda6d3e980d82a90c04800d4d9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee0ec929850ff6678d60774fdcb801fc
SHA1b20c64a8a3aca095b6c12971c2105be2e1ffa1c8
SHA256493f262a3b2eca9e4fbc16df5e9471ac3063cfbe8832b6440be6a84ca1a7a226
SHA5123ed57efc0fed14bd5b4ed68af9e02741608f59e34873a94719bc94dec2861f2ed3cb41890250da9af04178deede4de9fa031e334377116e5d722c004187bc2a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e701c6edcd11d975a554a074bf1dd05e
SHA1f44c90ddc4047f2e59dbb1680f098c1d67c5268f
SHA256e20110b46b9560334add3890e46fe9eefcbeda87f268f594d571162a9968b92a
SHA5127ab461e4e24b8c2a3beace68b43d4ca3de9fd74392a15ce6bc27c97a54501dec812ee28970a3f9b865dc3127eba866f09fee013dab3be949e2431b102ba7e848
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590d7b608cf64e8dd9f96b6726abfea00
SHA1d7dd892b63762ed716c124075315002dc6b48f2e
SHA2566df798ec08da7d1e5dcf67ba0c858a8b1a399c75c8e64063874bfee8b70d5e38
SHA512ef84e7ae592b697052cca874eb8a453c594448b7d0240b1449faf8a0c9b8333ee79b5b3a5376800fe9dfccc59d7f7087cbc5ae8e54899dfc4d1042db453dbd5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5158676045afed5d2ea521762c7f6c185
SHA1f5218bfc10574878d58bf066d1ee7d5b66d990da
SHA256b011488dd3f3cc03b6298759699bd262cc03b3e8e20191f9c219e1e51e2bcef4
SHA512c3fc8f1e2a7c610827866740d802c8d07c6c88d65187f742ec3d36f57326fe97771211c3ec4dc1a7c1f0603006e2506097a5198c6c1bf083afbbd0b0f6a7c3cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e802a0a32250df1ded54232d07e36db4
SHA146cf80df0da2cef502081390599dde4d87f8a1a7
SHA256c56d02d2c54d49bf9f62bfc4bcf88ee2b4912962c303615793f4117ec86c0a9e
SHA51210ee9109f2fb44d33d7b98011de8d54fa36d9c026ab9589a2369e85389983596186c4ab69d41812c42c8c81eabb291d46e3fa21ab9c967e38bec85e8b579abb8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06