Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 22:53
Static task
static1
Behavioral task
behavioral1
Sample
663f5edd47caf484d84b38f9ee84c133.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
663f5edd47caf484d84b38f9ee84c133.html
Resource
win10v2004-20231215-en
General
-
Target
663f5edd47caf484d84b38f9ee84c133.html
-
Size
53KB
-
MD5
663f5edd47caf484d84b38f9ee84c133
-
SHA1
46183795a2f6ea98f8d83c0da89bee0318131720
-
SHA256
e4129fa5a417b3ddf9c6523154fd8aea8621c8e3ea583669df0e68ed80e0cce0
-
SHA512
2d218cc1164685c08f6a7642e4e6d89cf8f061ab629a3e515687093ddb5944d6a2dbf6cc9ec661bd729af7c81330bab66b3d00ca382478293c9f41072bd70e07
-
SSDEEP
1536:CkgUiIakTqGivi+PyUWrunlYW63Nj+q5VyvR0w2AzTICbbuov/t9M/dNwIUTDmDO:CkgUiIakTqGivi+PyUWrunlYW63Nj+qy
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000006e232a14b3c2948f4f612064f01b56beeea1a75a7ff8250d60ef81ce85d6bc6d000000000e80000000020000200000009a1a361e08d1a6ef7d6b01159efbfbada5f92bae234bf283e2dc87172a5ea04d900000000f257980a0f3b7d07976cba5473e9720a5b466e5683395829c7847d82c429e594de76724bcf6b2ecad65fefd115600049036aeb9a4e0a8af43f8de5e0c188a6647fce8e35976950e706ba0f91c1caaa7b9f04352e4b194aad3daa31957970154aecd19671afb94cae6462b3f925dcceed29fc2992ace3a875b1f08b64929ee93f295d81974d67e9bea440e049544c49a400000002478d981ef5c480624c489d7d0cd47cc4baf93fce0cb9ed5d76e1e64d65b4312b4e15b3096cfdba49939bd5ef8d5054acd645c64a897c57a5317a5a53947be50 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000000a87d096f94f8728c109c596526711101f9dfdd617eb54e0dfb1112786ec2259000000000e8000000002000020000000e63f3ea8f2e85e21f1b364eaf23153e2fc01e84be73aca9ecd6b3d73f26d205b2000000052177f8549ef6009a7e87440c08679cc9e23ac91ee13b92e8095b426189690e54000000056e1f2bd352d6da3d32017098e10d8faf648bd323ed9019645e9557990ae8db710ca054c048c5e815e725a70068fc5a0daeaf11e26ca6b30fb8a295f1121d08f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0bab12c824ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55439791-B675-11EE-8DA8-6E3D54FB2439} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411794423" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1812 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1812 iexplore.exe 1812 iexplore.exe 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1812 wrote to memory of 2144 1812 iexplore.exe 17 PID 1812 wrote to memory of 2144 1812 iexplore.exe 17 PID 1812 wrote to memory of 2144 1812 iexplore.exe 17 PID 1812 wrote to memory of 2144 1812 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\663f5edd47caf484d84b38f9ee84c133.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b9e7186e35bce09e4f4c74f08d75e27
SHA10483505806e6a21890cd626a25fdc7874b4617e9
SHA2567a7d493ad00c0d9c6f39b03553c54615b85612f9d54dc2115c8650ea01ac9aca
SHA512db31909bb684ed2c41e2ae504e14917e7fbdc6c22650d370410c8cc5cd92f4722fefbf7d261cdf713bb94a98dd84e2f24c4cf71dff30e229c3cb2142e0b78bba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503374c6e9b4c98939e73f4572e1bc695
SHA12924e5f39859e32115cb513f5b8c94908a2a04d7
SHA256a08c16f86fcc8ba7f35d20262d295c5cd2c3cd5e2c15fb343811c0a92ef41b70
SHA512204e7eb3d3239b36119554a3cec7055c8f20c26b2b238d118d394af444cc54f4c151bc08e6a9df968aa884c4cbf2eb6a6b54ae78e78347baa9fceb6f57931cf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e548d3588922308c14baabd6bc021af9
SHA17957c624a35dc360c6588bd43a98673a54431d63
SHA25609b49183684f428366217bb9cd20826db2e63d40ac8c4a3c522572410f400a55
SHA512a165d438bab6c763546d666f4e995f4926f1b62ce0a77b2271aabd1fc367b225c1425241eae92886171595f03911e2eb0d63a9f20898d28e4c76517050b8da8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e60be6f2ac0c600decc5ab7960bfe2a
SHA1fbcae0a31aee204ac7b7e467397c15b4e55260ba
SHA25670032db224c295aded44238efa02ab7148c58d2e7821324641e057d2bcc45d78
SHA512f02499ea8f0233abea957d1e1ec8ebeb2de1e42b47614efdbfdfbe6202d4d61f3b4fefb8a65f76536d7c545d4dea1fdedbf8e81dbbae043b944284872d97ee45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c565d3f01462042b2d5ea3f48cef1317
SHA17206d3d1d4bfe755dbcce86cd8918ee56d3d1b8a
SHA2561106877019c75935d9607c326c3d335e4ab7315236d147e4c0eb0e6c64897a70
SHA51210c2d4e7543bb1bf1ca616a077b73eb9cd3d869bfa62f4a8612eafbf9e6e4cf264f23a0bb8b70792488eccbbf0c822af562e6539ab8d8c5c2f5d3882f17a04ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efc974f9169cc64afc776bbe4432e7f7
SHA1efb18998eba1981b26c663825e101fd8a1a90e7b
SHA2563d21e199cafa85061e3c6d391c6c032534ffad39a1378cc3b1b552d5b18d0b9f
SHA512f72901a1f62e48616da663cf3b9451bdd979383982630c1bd6f7aba3bf2cedf9d95de90428a0ef1052a5309f88ee646c568a981784185e02bb4b510d0cb6016c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594c8af6ad1d0adafd9920f63b0af78a3
SHA109046d105d4b2a0c7dc6932a02a32c6f63a68b9b
SHA256b9e3823441a9fdbba174ffa4fcd59f34ccd6767478e5103e09d3641317535889
SHA512fe95d0ae242a2b6b7ff8c3b7519b5c236c731b4d684630272ce8003ec0477e3a6913a30de5d0e463f33fe973c384cf7e4ad92ae66475327f255c73d8a3cb61c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b4d7726e611037c67b976adf19c05b2
SHA1b072e398e4537db6e333322caf2894847ddc6b0e
SHA256793a3c1c9f2f39d7bf5634d9944dbcff2bd9e05ce89c75196e28ccd7f4cae108
SHA512212369fe571604327d70ef6a466944775ab1ed09c2741c71fa35d3d6027f500072fd71b72f0da20f73d4933e481941905f285ea9e1022fe52ed60e5ee1e13d0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5b03b730f77bf1a77f44963d1018ed5
SHA11445cc6f1b2b4b55aa372bdc1c6cdbe0f283d791
SHA25698c1377a8c977809f743496d86c68e868d604e7bfb04a81cfe3ab217713e2bab
SHA512a14638358a36bfe212fc1c1259f96aa172ec9fa3b0431d2e8a20d2441bd2d57f22fc68d9a8b37249b0404e29ea532a077e1a543379fdb332edb3517ae9f2d22f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6285e773583c10c7cbda4284e98baeb
SHA1af220c54d46a01fb3d925bd634e0948cec212088
SHA2568bf2069ea2b4bdac2e1155677cdbd96d74b269d4e837185ccca66b90780ce767
SHA512d7d90a0033623cef863a2795528b4caa9da92633c4d20f93ea9d11bfbfe12c5597ad9ef8dfd6f1ac95d17894977bf94f75874a0ef0989f7b3f2b35b89f7a59d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c117fc968b588c068dce1e486eac2bff
SHA1f50390e73f5818584532782bcfedbf7d6161df93
SHA25678fbefa3ca4d9157c7ef05459045bf2fe307fceeb296d273f59ae2d1fecbf2c6
SHA5126c03e51849db38e24041cb2fd6dd8e35aa50280243e36b7814e4189226d0028070d7a00f8e888a6c9609cdd7e6bdc9f7bee71c1750ce5133914f1f2b7d3a17e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b050ce67aa6a5e1a914a9f4dbfc1a91
SHA1398f762a412dc1390f88bdb685e6e904ee890758
SHA256d1798372622396d21ab2a668577af27996242ea7f1ba221a2ffe158d46c756b3
SHA512fefb6d783c6fcacec6b7676778a9f26c45d76737710ada61407e429f2041baf2054513b9e9fc2a46f2cc4a0ca78fb440d1c3b10182c41fe0a2ab519a6c111414
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2698a6fbb183bad74e0872544e4614a
SHA1a7148a5583585835c19485031bcba2149e2f9d01
SHA256124d50f2bd18188817e78cfd5d8b5656e8507165fffddcf2ddcb01afebf70369
SHA512844e47cffcc6350991fc709e05cbf5a657f8fe06ffc922aaa388119cc96b31d69263fad92376ab863cc19932c639fb6d9ed8728cfd4cb003048970c68cc3f59c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff12d121fa24f7d59b7fa7d87816d83f
SHA165dd60dc0859f664c48a1ff72dec3659301aa031
SHA256e1bd4d7bc6e14c88512287661f0e3a482fe0752544782eb298b1f2f95992cd92
SHA512e8657ebaa3b861fc521fac33261eed23030d111b2db460c8778d95146acb3f8ca0edaa46c5d7607293e7e5b39165bc836e566c68c4de6f31ce6c7148d30b3bcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea15329115af6ff62495814d868f0975
SHA175c4929f7507d10870e190a8a2575000a1be8928
SHA2565f148640db7cb7eeb0aaece220386273f0f4a08b65b9809256b82145db13026e
SHA51214160297a2a1519cf7bc8c9a6b100250461efb1753c311ae44f85944872a0944e7894c11099bf2ffb50dc9697807f0eb13061f7f16e136675368f801b5479a16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542f6cb5984e61560cb08c0d6f792b500
SHA128c8feda2d808828a12fb29cc30d3bf777d07091
SHA25602bcf15b5e6c5d15326e5fe4e873364c0171c61b74b730aea30a643e354baf4c
SHA5127efff779146f45ef64b750a8314731ea4de14e7083791be2d5045442582bcdb6f5397bb48a185f5223f06aa941c91c828d4145671a1e2e0403540f1fe78df9b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5549a880befc9d6a70b8201d832915974
SHA1c7a65b60d9005ffd7f4056cc01bd7e49b9db2f3d
SHA256cb0e7b3388eb3c7bdf916e30f36a0f4b6784762ba558cc554ecff1a9d711e37c
SHA51206206e27b834355412740d4bc7712bee74fb3291afd1d8f399a30f4068e0216c9406170d5fb231eec3a2430941ac5f92f32036ec40c2f1ab87f557b16faccddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54651457cc40c1394b010dfcc9932efc6
SHA1a40335b17daa29a07b2ca10d2030d468ef005869
SHA2568802ec431f1f1bd0bc176afc9c0d95e61f57989c2604bff5abde079b8f05f8fe
SHA512fd34a761ebc8821fa17c4908ce6d88579ecf83b13170b012feb4048b1b20cb7e0460af257fe546f5168ed4aa2da3496ef8645670afa5f5ecb9b1acb815b5543e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\script[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
62KB
MD5af64e59381930a2def21e74a47210ac2
SHA141ff59f2648a3ceee02a766bf5625994e97554e4
SHA2562b32ef93d406db6fb71547f8a36cc0277b613cd146016e3eb470d0551deba794
SHA512d26fad4c4de461080c22497b72c5a0abfcf844bcadd31b5aea06f46ddff6945a5ddc9eac22aae39c9b7e97224b735f324df024d688b2343f294933ef8b84bb1a