Analysis
-
max time kernel
147s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12-01-2024 14:41
Static task
static1
Behavioral task
behavioral1
Sample
56bd1e8a4c422732a73bfe29d05016eb.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
56bd1e8a4c422732a73bfe29d05016eb.html
Resource
win10v2004-20231215-en
General
-
Target
56bd1e8a4c422732a73bfe29d05016eb.html
-
Size
3.5MB
-
MD5
56bd1e8a4c422732a73bfe29d05016eb
-
SHA1
9db692525ed7df261524925e944e9ffc0b3f752a
-
SHA256
9e6568c2b24807e8b89602d97c819921b701b9a589630a970d834a87fcf2ca87
-
SHA512
bf18c2099a8528a14dcee737e0c95edfe51fc33f726e9a9b8c02ecda7b4ac4f84a626fa972bf28440241cdb15a65a3ca1fbf5c64c7ac2f15d5dde932f4c8178f
-
SSDEEP
12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NfT:ovpjte4tT6NT
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411232384" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000005932bfe5d1fe69ccb8bd231c90903637709d68b657b7addcb10f2a106a61ad33000000000e80000000020000200000008ba7b83fa766e1d39b1f8b0bba67971760c9e9d7afaa4caddfac97efdd67ee40200000003042923f3fa12367a56b8185eee5ca8db8134983debbfb201e7176b14df32ace400000002eacbb906a1d436bc37f19a46635d3ad50dd041f0df74a068241c2dc2ff84be824894a8699b6b4e9d23afc4237758528590ec2cf02bc8b26d8ec8eb4a4cc6e81 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000004fa5b33ed5fa29c6ae183f2bc4a7251bcb9fe367417d6203d352cc44c9cfa0f000000000e8000000002000020000000a758e04b83b382714441627360b269bd5c51c4e10f3fcb178f06aece6cb24f0690000000ad545309d7a6c59407abd236602517ecd43867116b87c6367a45da1825bae2e1db6786d8faea27779250be05b40dcde4285e1e549bbeb8630652d9bab9a6f34265e493b06ace883ecd0ed5e9714a8560848261bbfcb7d3bd3a0ea43534eb82c21ded6aa45a5fac44c1badfa40b514e7023d5e28b03ccbc0304f6a3378dfe1ef7e8d79313cdb0524f61f25946914478a540000000404e9fa498a4fe23d7361427e292d707f6776dfda8764f784d953cf0118b06d2f78442397afd46fa7b365097bcded6da1694de947d6cd62019cda40ac52a9ece iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B427FCF1-B158-11EE-AED6-D669B05BD432} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00911aa06545da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2020 iexplore.exe 2020 iexplore.exe 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE 2624 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2624 2020 iexplore.exe 28 PID 2020 wrote to memory of 2624 2020 iexplore.exe 28 PID 2020 wrote to memory of 2624 2020 iexplore.exe 28 PID 2020 wrote to memory of 2624 2020 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\56bd1e8a4c422732a73bfe29d05016eb.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2624
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD58f7d8065fb9386a18b3ad03226ec1a8d
SHA11a6bed56e6f626353df898be4c96d8c9d763ccc2
SHA2564aee471243355282872d725a9e72edfe22fa2c8c0262bfd7dcb9b27238994f2c
SHA512f042f342152e133d92715fc494e66f4dfbbb3cbc6debfe215070d151b68a3056ba597ff9fe79da8ff1afe946ca439a17e73d21710d006d7e16352c5924edbba9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b0854140099782f75df850bde981148
SHA11d2b2c04ec779128eb95ed2ab4804f1076ae13d7
SHA25624d286cb52ac5d6552e241354c90dc50e667b721121c4bd2a49c187b81028563
SHA51282c3e0563defff53f59c2883a8b9545b43c1f8ba039681f6e72e498e2ca890faf4de7a735646e515173643994f23d1e71ae88bf657d1ef912a41059a5d703efc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593b1b9eff2d8e1758108c383e68799cf
SHA1bfc07a24fc6fe6e67a97c93f3cef7082c8cf51d5
SHA2560241115cd3ca04cf82b438060650000fbbb9ffa7ca84c6674b30f21eb9f0b6e0
SHA5126e050515769409b937f7a54e2ada5e477e58a9fcb610ff7ac2d2699e17d75fdf7fa678cf6e021eb2e8e71d14fcb82443b3bea080d05f06162b15cce7c2291cce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525fcea3cff8211d545a03ff0b476c98b
SHA198008ac553ca6794d4ac70861eaf08642eb0592f
SHA2564f40f3797985f691a3a7b4b48bfd9d0584434430f003b5d290fb64f90c337638
SHA51237f0522741b9110004c998d47717f9e89aaa20c67b65fceddf23a9d7cfbf2650e4678102778e19a09ae797cccaf21247b3ef52b7e83f9d6ba1987371c2961657
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c97d109cc977394d2e5cf69b5066c63
SHA1715409f79c13a6a4e54f689f6c58a7dd349b3c82
SHA256380e3db5bf0abf0d62c6b395793394b28b68cd8f14ff5350e47300150870fd04
SHA512f989aa735f5d2cac64a7304137508f13e63992e3e955913e5fb2178219808a99d0887663cbef8aedea4e0c1aa0db35de7361bfd366b1e3ef5443413549e0a7e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594f7426bb4b12093cb13230bcdc7f67f
SHA1bc1eb8f418ae050b728726fd648be5241462ba08
SHA2563aa6831992a96f149fc748930012841220eb197fdcfc5263f655d4592938f212
SHA512cb02ea45fb8d64c7f8082c35a596446cf21c86cc2985a1b6e29d678d70f5d80c3096216f3ef93ef390baea5c32d67712943cf84764e953445a4751832115c468
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504179649bcf3dba67bb0ee90851494dd
SHA14f7ae177710b01d0e99da633996201047977a0f2
SHA256e459a7d9490b31783a5180f7d4cfb266512eb269d4e20b1c83208e09f434f7b0
SHA512495cd93c81183fa20121bc20e85773985f6f5491d0661fa52a6a0abf5466e15fdc47301549690060a5c4e0731578299991ddfeca44a5df89cd53bd732feb36ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58340280fb9837445e664ad21f5288ad2
SHA174655aeb02039652484751eb22d2e65d1797d6bd
SHA2566a6e69a57c74403fcbe6f1ae2c184723426114b448bc9f10536064ff6904bbc0
SHA51238db1015ac3c59897fa38cd3552a2ca5987bdd5a3a43c44962ca6470a4bd3c7e2ec7ccea4e679bf6daa9ec82c4ae7e3a2741ec5f9248356bedc168ff3f0efdd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de54697eafbaece25c8936de07b8886e
SHA14b5d1782e3dd3ef5c7564eae357955d2b573250c
SHA2563851a454ebe42d1ad28ae61acd317c236358cadbafceca910b3e4c61d7e5af39
SHA512c309048bb087661a9a5cf3d2981b429411c172e066755c48032306f077b9e376b65c1f424ee777e4818ec97edf763d771adb9c89b7dadb0203b7b1f5b276bb5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c0b8583bd1af55857765d9bd45cb726
SHA1872f6b3453ee1cd42bd5ab469b2bfd53412ada0a
SHA25642c5831c564a24822b014c20fd05bbb8f53855b43bbe069129cdcdc514a4e44a
SHA512ac04b6a1c8d394619fa8923e026318f2089da92dbc1d067d87e69656a91aa8b98f6df681347c8c0ea5e63cb233a9b2ad2c874063b2c7594426387023a81e43d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5c0905b14b9e591f347df38ca236e917e
SHA1a7e7f527e0222941ec5ddeab72c1a4cb0adf8d2f
SHA256bafe92521e5c1b2ac90f5dff87252c88c46b507d5f0077a03cf1dadb5572fcd9
SHA5127cbe7f095906625874120db85dfde3aacfe8076989e11a7efe508f39f1a58cd47a3bfbb0d3f80a6e17bcc416e993ea83af4be5ef26580b6cc9e58766d511e73f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD59c033b35b02ed794c5392ef60107f309
SHA161ccf8fdeaa060619c489444ee4adf7c0dd6ad3d
SHA2569518eae91c55ea8324fa913a24105a89a7768241ce10117fb6fb6f219577f8d8
SHA5128f82ef2cb70259b8e96dcca8d09af68428e74171588d8e1aa64d89a3b819b7f91579a1bcfff4e19e458c875ed979ffc2e1d1cb89171e7ac5fc1adaf79b8a0f84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\19KJ3FMM\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E7PYGFSI\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L8NIENCV\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06