Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 09:30
Static task
static1
Behavioral task
behavioral1
Sample
650d6a847e728591139b0a93cead7a64.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
650d6a847e728591139b0a93cead7a64.html
Resource
win10v2004-20231222-en
General
-
Target
650d6a847e728591139b0a93cead7a64.html
-
Size
9KB
-
MD5
650d6a847e728591139b0a93cead7a64
-
SHA1
9caa043ce101183c7c588973c3f331f85d3cfb82
-
SHA256
e3fc09d2377d1df5727dd16f1281153c15f2ddbf990d278e9d0771c31ecc455a
-
SHA512
a671061462bd5efb0a4d7d3c1630b55d4bb1dff9b84cbb2c69d5652439a63d46f9d19441b9e5fc8a23b0c4b17742d07de09f6af480d01734b7d60ad6ce065213
-
SSDEEP
96:uzVs+ux7h5LLY1k9o84d12ef7CSTUaGT/kK5pf5ErNCC7tlVHcEZ7ru7f:csz7h5AYS/rCf5ErNB7tPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000810ea4d716450e64bcfae42db7be6db0f11075d729619dda7c1ad76797b4cd9e000000000e80000000020000200000006d5a1d0bf7635510bf68b06d02de6636749680e7334efeb8df261f3df67a33cc9000000011e420464cfba376342d2885863f871dfe4f1a80d970b47d5545ec96e833471e9b3922c974baaa49422918098967e0e1a5e3c8c7872a892a2e11af40258e4af2b7396d0e9901e38bc36a138752b2e696c234a10f2cebf0c2f8889aeb4e9a33ab29bab5ee3e522714896c5f4b162d4acc84f038fe67cb2b657f9a41bc38d75b3c12ffdc2bbbc835bd41a5ccd3e78cd99e400000005290fc1265d09793304c05d9ccf6bf914a40e3f76554d9a3bbead075dbb12b845bdc9f6f3a8a333ac01881f882da30723be3925a37cc832ff98fac0cd120cd2e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B0B3261-B5E4-11EE-A8F8-62DD1C0ECF51} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411732128" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000091d592dadd3ca65f9ae712c337d78285d7eee1ea7099483a41c10d357e3bd893000000000e8000000002000020000000d72a6058b586d0defce5c76615844fc7648f7007763e4f9e8bd41270477c881720000000c75b1875b0753091316ea5327a828820ae37c65b46ecca9439fd69096e52141d400000003dc920cbba565235628d99061728d09ef0fed5991545fc8a32075930e02163ac2478d10854fe2d58aba3e7c15f6a1440d7bcf7a8b840a5e68a4e86a056ec194e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906f6420f149da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1988 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1988 iexplore.exe 1988 iexplore.exe 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1988 wrote to memory of 1932 1988 iexplore.exe 28 PID 1988 wrote to memory of 1932 1988 iexplore.exe 28 PID 1988 wrote to memory of 1932 1988 iexplore.exe 28 PID 1988 wrote to memory of 1932 1988 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\650d6a847e728591139b0a93cead7a64.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55125bc1b76a196131be5e3efe71c20c7
SHA1c5385b6101a19d320c15f507b2e85a6c1914eb28
SHA25613f042b54ed42f8655bb7a26ea11b9189500ac2bff8612f4d1c9ec09ad534fbc
SHA5128a8a4628051578c379d7f1b5240a4da715fc3c4578d19e412ac0421dca2b928e9214d6ea5b4b12f8b1bcc3236e67ff4b7e8a1325cd26ac8237b0e7d7663b0a87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eaa4cfa03755fc9b58b1f395db0550f4
SHA1be6b4f51b252abd1fef61b54838f095f697efb59
SHA25601efdaa56f6594411f6a75af1d909d6287da809757c7046244c39d16a7b84f0f
SHA512f8d94d529bb93e75e4db3fba0807bd6a07f52d083192b3e7f647af892fbc7587df7f609e99ed3e5cfea6bb59def146ce1c8bfe7d1fc7ca01bf68ac3dd4006812
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594d9c443b80a595542ac94f1898aeea2
SHA10e145ce572dc93d203c6a4d782ca9b63eebe9be9
SHA2562b094b2bb040d99aacbfb797d965f0b49876066852e44903d3cfb2d38fc49de4
SHA512bd2c388e3cb4176c835284f3a80c2c80bdb4667e87d36bda5f0cb293238e3fd9d15375d0a918f3e33d14132257cbe6641fecda8e3805ae51d6d54517b12d5a44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a73ecc919aebd3d7ffef6f462a9fe2a1
SHA1e125fec990f1f341e7ecb589ae378da28f6f83b1
SHA256033eaf33700ddf493dcd1603cf59df0a4f7a355e4fe584c4cca8a3ae31517a1a
SHA512b18089d70d9f5689e41b0e3988a0191090aad10b7a1b598a44068401c1c864526a2773112608f9287fe0e4999243fe1d71f6e6c68665f7550c1411e92c20556e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef2cfaad3ef67e92c81b0a0aeffe5c39
SHA18d152f99aa04e2ff09ee505aaa40542a79b8a072
SHA256dcfcd3f2f75fe4ba4b312dff03d2d9dba700ad1691ce1ede371f16a4904c1ad4
SHA512cd4290dab10debe9bc7323627311383e1384e6ad48ad6d0a08ec924619146bfe36db0cfb22d0b9666e69b90a23aaaf7cd3335c3db44148e99ba7310df41e1443
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5642637be7e904cc51ca7a452fb400369
SHA11f405a0bf18253c27f4dcb36f8eb5d0c99055ba2
SHA256af7b3eb04a03a0b9a804e41b0e18d426a7edbedc87bf6183d0238169505d54d7
SHA51208b784965546aa294e54e96784ea9137763cd54fd681a29a359050b39532f87de9ee470371e7d0d96860e16d8530357b5cd9a253f8417abb51ae3eebad97082b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbbcb935c4af26724b19aae993132920
SHA1f9488da8c5b581b1b9db588737927bbb5dac8bfe
SHA256c50b3f3d32884c6838005ffa1d3552a5268c4dc98d173210c142d4b9d236b5d6
SHA512c46bacea5b320c1bf17d5ef856425f233e993e4581428bd7a7a1dba1e8450c73e96bcb4668e273e9ec795afc12360af1902802a0bf601d2ec3360b159d347cea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7df09dfd7bcc289af3d5acb978fb05f
SHA13fedabaf111cac3d6266dd565f04aac460849e02
SHA256e26905c289fb51a2c5e1dce3ce2a9e1095df566662a0576370e07761c7c35d94
SHA5121a12c6c28161d76f586e0628336f043ae8b633a0ce8e9924c9d0fe4c795bb0112f02ddf796841bcf8cab58416e3e04db36e9b832a2aebbb2a263cfd7638676c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae01fd16b0980fc2b2e9522a3e67aaae
SHA164794d6aee3da100dc4ee60ede71e725a20c8b8c
SHA2569bb1a494d32f2b6a3f009e66b83ffbc64dd84829ecf5a18bda73d4da4f836164
SHA51209ff2a8fc3c7f5a9f1c7153601c77495dac4df5fdf998fca491af5ee4c905ad1afc6cc97443d2381741c6799ca86fa77c92e90b2c2383a727d5708f6b46af552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ed6e01a14cd8f0d59be5d374c85e417
SHA1c11588bee2fdd7d1f187e1ed1fab4f062e1305b3
SHA256c190e6b7147ebcd24d8250e8ad825d7c9652b8188250cc3958aa6f928f256baa
SHA512b9ba83dc84d91bdf6390dc72dcdcd6ba29074f2048c691e6c3a3c9a421b1e6c6a914ba2f960d03b258afe5a15696c71abcdd2acf5dadc48c6c8ff3da5ae08ede
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d36d972b65ed71c0c6708f0bc904dbb6
SHA1e40184082569eb25ad5abed083e1cdc80156602d
SHA25612f8a216c7dabb6d64b3fba44351d1741dba93116676d48d3aaaab1e83a4b5e5
SHA5123dd47dc40263846c6ae68b6ff5591d3e8336cfb841f90a665afe9c66d3672cb6b7f0a9b08d928f42a994b503b543644b163ed41aae40edd24c662de422f3d88d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ec088dd85d2a6681028da1cb34622ff
SHA1e804366dfcca3463b6ab12942f7ac32593666b11
SHA256bab15d411d2653cedf0fa313fecb532b7b0ecffb2254afef2db7c4a5dcf61d01
SHA51209a51979bf5042f924929e8c4a0da61ac4c34329321b4b0272862ad0c6e37550d6cb8bb5d5b41f689e0a45ea7c05a60487358497d00eb5f9bdfea03cff1faed0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598c9048ae40f967241ea4e2e43f1f007
SHA1639d2ebb2161712c06d7c335f69e9244dffe1f06
SHA25634a6e1c84699516660e93b7b99ea5c9df8ba27da1c4d2d7ea3d7c31b7acd0425
SHA51232972d3cd94674cb13bbc4f750b7533128cce54edbc436dbf2abf2a8af89ebbbbe5f767b145a97d401b3eb9834fb682dbe13350b6f130d03991fd56656e7a61a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8b2072ee3adbc88e412317aee2ef4a8
SHA1e058a5754c6331e8603980dd7a2b9769a76beb26
SHA256ab96fcde621435e4e421fef5211a535947ee98d8317a550b361592e527c4deb5
SHA512fb02ac25f7e35a35d96946a5ca15869a614f4ab476f53c253940b12b9191d441588a2cd41d2659eab8be25590377c12f405cd3825c9efff5132f9d92ec23427b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2a5f82ed6fd86db0e27f04d8db6a975
SHA1c0c22062c0e342eafb213780cf9ac6190b6c94ea
SHA256d61b93c02edf7a1fab0501a3a6c5c3819a5353ebde8220f3db1cb2a659aaa368
SHA512ea9a0db1cca3780cb58d80cd7093b45a85a17a6a17e066aa02bc32b9ebd9b08e5a1fef5a2232a721056f1811afc0a3723541c2135c254d02174188cf6b30186d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539311c8d29d04de2f22a6f736b3b0381
SHA1dc232202505d1df3e64ba9baacdcdeda86a85a30
SHA25674ca248fea215f6611c53382681ccfcd0bcd989f8a44b226cd298518066c5fb3
SHA512b21fed9b897aac4516e7cdfb26bcff92d330d5ab26f7bfaef2469090ddcda52cf4db7ffb523b9fc9c17de088cba955cc9294a5032b55f41c7af68eed3dafd5b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557dec32123b265aaed21261434ead62f
SHA1a56a37763cf706603bbe03268602ddb6bb627bdb
SHA256125cd4c849e3b2befbd4c599a1e9425b06141c77b194c5b475b5fd8e9d0416ef
SHA512e11853ab7c93052b4d632ef59135e428a4cac0aec4251a1b93901efbccd1988623c90fa3806b018a0fff8b819ddd3ee018662d43e17916f9ab1c3ad7672da681
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b81dc009980cc02f7c512d78c2636e6
SHA1ab25a2a8e857c5a33f445f0dc5b95fea1be77e19
SHA256d9c6ef24f89569fc82b8fa55c8e7071fdc12d757cd884b7e263674f0c658c031
SHA512fdc20596563fa938c1cac3f7d4dd333b3571559381ebe8b345fe1e893865f2081bcd36d7f890fe2f40424ec0bdd1b657d5dd4ba58e9f95e03c4dee6204ecc606
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06