Analysis
-
max time kernel
145s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/01/2024, 11:03
Static task
static1
Behavioral task
behavioral1
Sample
58c1bc471879e5b1a8dee956be8e7db9.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
58c1bc471879e5b1a8dee956be8e7db9.html
Resource
win10v2004-20231222-en
General
-
Target
58c1bc471879e5b1a8dee956be8e7db9.html
-
Size
11KB
-
MD5
58c1bc471879e5b1a8dee956be8e7db9
-
SHA1
9e80a7b65d19eb833b62c276b6cac1f56e338e30
-
SHA256
e080c73de81c5014142cf6a9a0b7e32538271b2772b122ddedc98a64073acf73
-
SHA512
35d289f38f9304c478f46b059fc6a22bebab85865dc1a657ec493365dd185cbcf729a44d0f1c27c001eec640893d8270b23f282141596579c7d4d891a4312ecd
-
SSDEEP
192:f1znpnVzn4ns9vn/vnqc3kRWt5XoKQ0I3nhbgKAsQqBZXImgs6k3sD4JX48gpaeD:hHCcoWtJx6nhbgKAmZXIm16k3ls
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000019ce19cba354a1c3665d1b1aa5556b7c48ae795c66dacbf3e57b4cb247d2d0ff000000000e800000000200002000000059708e8495176c404270bea2afa85346831b14f6c5302a605637bac6e122aec590000000946bb12c5e47076b00767ac9adeeca7bccc51da4b5ec5b4567c9718f891bcdc80b49650ae586ff4830244d1f0d07e573ed7a03f8b89ea1898074f014821087784d823ad6edab8025c0af07bad3446073bf9c0d5f461340e673ee93470abee42b1439ece95fa3fcfcebaed24c074eac294789dfc3028e34fb872daa1c5a4f9fed5463afa3e0518ace3f011e955bcd091140000000d62bb7640ac7bb4790a4084664d6751a0a4e1ca36b6b79190d28626b550be1345ef5b6d6328d1b495c9673372a31dfd54d8e4b44e82929d3a7a52ae7592e6acc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000dd53ba1e799092ff72ec2b1a18fb26eba57db02dcf7365c6c3f7d27f92ac1e82000000000e80000000020000200000002c02ba0d0b99b5099896c59db6acde4988ecfec0ebf6d996b79c832aa3faa64120000000e30f6663075e65f7c2ba695136e4e11b9623a4de6c68e100743c0861cf14d4544000000078239a6a9bd8965bfbd46a3ffdfea62df6d2a9aa1afcf1756c51e57ddb88616033ec53970dcfb8dde72c139ba0ff9f1982b9807c28b8682cc5f1b868648c81af iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{630CBFD1-B203-11EE-9B28-D6882E0F4692} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306492381046da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411305682" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 3016 2036 iexplore.exe 28 PID 2036 wrote to memory of 3016 2036 iexplore.exe 28 PID 2036 wrote to memory of 3016 2036 iexplore.exe 28 PID 2036 wrote to memory of 3016 2036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\58c1bc471879e5b1a8dee956be8e7db9.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596b2b02b59e827860e3c2f872207b950
SHA1e2c2304a4373a3d437a1ef4beddc9a00dffe5071
SHA256d554536aa449adcfc85b09545c6d39c0c6170fb2e6a1f451232a610d99d0bfd7
SHA512cf1dab7907b74aa250b9e75881b4159870fe7d7142010dab53b4c4eaae71e5258efa7bd0eac5f9d94f5d38e560e39d9277c9b270939cf2f967da8673cd6d4fe1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52132e7d77b01a68ef315e0ab62fab55d
SHA1175c24f30f9a6a2e1c5f26922ac5792cc2947008
SHA25658274122e4c21b8cecbdbfd628d09644c557b92da177132ce4d946eec6c81dd3
SHA51216312588e81f84e1918596ee9e400a77876b9fcce9b6a6b3b6db5977cf8478d1adabc201a49746c0b540f1fe3886681ed8492240f61b245df8a24aff6a102daf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5919c3e6d21fb14685d382699de59f41d
SHA1028319df10e494c66818a016db597c58cc85b587
SHA256a391c6327024a7f2e30fd5af088b2b256ed56c9d92063d5f6bda058e7af8b12e
SHA512adb0f5d0bdd11ea39a2efbb6d8840be27fe1e2c180921f5d4e80b0dc9bbfb498b98031af38c80d854502b502b2f50ae620cec5d223e086e58a8881d559bf7a6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59dc0350db7dea8b55819250756821cae
SHA1f682f387d32af3e2f211436c5055d1d72429abae
SHA256d3f91f0ca7d2f3ad084c76b62e2728f3ac0b831f59783be914ce871840ae889c
SHA5126c02d2da3bcd2124c37d7f32d04e8a120e812d311d3c9df4e55603cdb6a792dd276aca5a756aa5645c355f9638e981105ffeaf37a13405d0a589694502ef4e2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544a3907486ef4b3568cae001f90419bb
SHA146791a9f969949b94d54fd558effdda49ba9289c
SHA2564f252580c25fda376cc059488825bf12668b244c58c86d2310184fa713656932
SHA51283e86f784021b9ecae599cc61910fd2a1842db3f965cce11d03b0b7cb9ddbff959facacc8c6128fbdaab9b142ad7ef181b2ad614bfaf7c92bbc9ac9bb773e80b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6e479db5abe96d5bde197b9df7f13dc
SHA120c6a21c1b4484a29d8cf50fa67502893fd21173
SHA2568ebff0ce3166f1c163f2eb4680535dc09d3ac6b135c8d52a92951f9a22beae56
SHA512b9adfecc35c98f0b5c255fdbb441fa7ef0e89a821995e33c48023c74964d8684b1da7770c6782db5dd275126830cf52fd1eea53886bee74d787eabbeab2e3cb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51603357879098a00b8a73f771bdefbb0
SHA1393b9472bdb0d8d2fb98d4d7b43382f6c637ca24
SHA256914ee3e93486f75c6b02fccc5a818f249246ce6e557184af00a703a88ab66f1a
SHA512da2e0ca9da471a47766f75eac8b13afc9208a4ed8712bdbf33c1d893778d28d7f294049ad221e9c45551fa7abad7bd13f5669e3539a4f9ecfbc2a65d0efc91f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ff2203087b214a5751b60dc396e14bf
SHA15401f3d73be9c4b15bea85bc2829c74e62439dda
SHA2564c84b5e2a7ffe0089d17fb0ca4c1cbde8869ca49700ccc595105b334f707e47f
SHA51202df7c389b317adaaf81e87d6b3705b213665faef66e50af19ae71a1ba6d4b5677f41fc8e3486f4544ad339e8561661f1b0ea1280f2df42bc1cddcc6262b3e89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a0582ab89b09feb1740d2f747fa9f0d
SHA1e3aa77666e8b0a851dffca654aa26e15a6d48996
SHA25600a829d5705cc5cc44a7ff2f2a60484960a2708732e882ebf2dd89bab0f11d04
SHA5126b794e4c04f5711e6a4afb18ce9156569fd079f1e01b9dfd54dad344e5f5ce1853fe65b8a69e65456aada82c566a61da3acb5b1f409ad02b79c283c84983e29c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd24c6742fda0f073867d35672325ddc
SHA1acd01f779ad07e2d4d99957f270007a9e23d9c15
SHA256666cc43b92089829ed4da425b23779c41a1c0723751627d186ef838f091f8ba1
SHA5126f363d2e756d7afd4697ed982924c85e3d06f91825fb74040ad3f131af6bbdbd6d92e86af1d5502d0e155825fbd55c7f0f5adef4a3a2924d79d065b20d6caa18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5069a4ccf334732463facd86bb5b90963
SHA1c1d743c7f0ef6a84fc7ed0708e28243a85684a7e
SHA256f8def3788ec5d2e7c5b8695650c5d98740a4efa49f5d6d75a46affd58bbb35b1
SHA512142079910a052328dcaa6cfe1c36a46f23789767cebd799fbe44542283c8cdaef3b0f7437fca413f4d4aff070acc179dcad5a3fc7bd83fac7fc2a567bff559fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58817415a6310cb48313e5beabf0ce795
SHA1686983542b93e13b2fc82a8a74986768ae793cdf
SHA256a9b3abf832e1138a18ecb6d40a01770561a3cf991792532659576dd24af69a08
SHA512d526b7126ef8b0411987f9d54cb2f0b2740cc73776276f2b656ddb06f0635d440ad98af109791bfe6763000602664f1949698709017d89cc8ef8327724699761
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afe3eddae6eb85fee6fd911ea01142c7
SHA15b7cff956badc47f2eef1a318852b2554800738b
SHA25692a751f5fc563e2a493175962c7f4c85ff87fbdbb694c550717609707e6a263e
SHA512518d00f9dc9debb6bf0266bcd6e0166f0d25bf21e744a850e8fa438667306633ff1ae404c2ed440b30387270ca9e9c4d61fee86adaf696aa62e2a479988ee636
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a040f29cf3007ad1a6983b2a08556e21
SHA16fb34057d7210935e363f37e9a1d774e9698b55d
SHA256a87e82db6f31dedeb1d69931b10212cfb890a75c1b5eb02e5cd213cf309a4ae3
SHA512b846084a281956680e046bfa7ccb0e5480c144dd5a00563c77bc3557a1a13baed852813a7c1be611b47feceb631626f8d17c5a68b87a69cebaa4fe3017e77b74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8d9c0cf7714d1ef045cd4848f9b4151
SHA18ecea982fe148a424416f8f68d30cedd506293f7
SHA256824d1c0d57a72d407c75856249924493d7cdd96d7fca854838f6edad3e487bb3
SHA512dc6e5360ec9e6e41d0a43c3b4542cd651c37addc5222cd17ccbc3737399080da39cd20a01502d6340f65a5ae10c93149a54a86b45768fdcdf188f5b7deab02b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503095dd3a0f45e4ab53fca53591fd5b4
SHA16e27824a7ce3c765f0b5222e5127be85e55a5543
SHA256d059941cb4222c8df2fe05a88837296cea851b99fface470534f642e8c688b2a
SHA5126a4e9593867993266e1ed044972d21f844611bd182ba056440b4d03dab22484e002c9198d6fc5f16c91273fe96e9e98410bcef83e73b69992be2dbfb4a147490
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528d92b17f902c4ef5d0957e65ab0bc24
SHA1105f89ad0e1674c7c9e39dc6804ccbc79918db97
SHA256c2dc487de2239eff68253e08c8177ec43a0b2abd0cbf4e1c423361b37b87a9c5
SHA5127e1cc6d8e43f79e0166e2be074bdefec89aee8932f740910bcaf1fe0936de7329ff1f7552820376a98c6abe30ff00291f198f7bfc61321c3b7252523cd06ae08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d72ec246ef842270c558c9e360bc1bb3
SHA1f99b4b6f27f36a3954d0f339e698d20f98163273
SHA256398a534faec4a7c31419700d7c5506b27f12407fd487728dde77eecbefb6d183
SHA512af3351465f8dc2005646830ff5815fe051209a9c266af00e75fa32cd23fb29124f0fb7e5c746ab6443e08fffa809c802bd29d161efab6089023b58046ca29e4e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06