Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
679f7abf506a3762bb72fed3afacb5f0.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
679f7abf506a3762bb72fed3afacb5f0.html
Resource
win10v2004-20231215-en
General
-
Target
679f7abf506a3762bb72fed3afacb5f0.html
-
Size
4KB
-
MD5
679f7abf506a3762bb72fed3afacb5f0
-
SHA1
ff49fa09b5000c025aae9cea2d53e15052f7b4a5
-
SHA256
2df17b232a23e8f3abbee107faa17d1a2394c476b2e38033e659deb831bf45a8
-
SHA512
b07a0161b9db2a545385d9152c3c235784a9b4bc775f1a3ff9db67b47896a0c0603134e443cc012f1de2849045633f1f4122ffa972affefc3762e320e27e9285
-
SSDEEP
48:Q4Vl0lpikR6ZHQToSAgqEIp/4b097ZrD+2jCOHy29atv:AzeIUGIJ1NF9ad
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000b8ac176fd1a7862d23f96db9f4aa73ed9f7dbf5bfea8b4025428280e604dcd35000000000e8000000002000020000000739cdc6fa263607b340a3cec86b03ca1995d123cb92b464edf6a858ed357eda220000000e2740ab521612fb299bd5957ad497ac4cc647a474acc55bafaa0feb6fa83988340000000ced6dcd5cf79c3ef3fea0c1ebdcf5294e0914f91dda0367ef1e3c6b41c5fc0daa0e369867c26fab1f4344b8c8d9686a814b44c5381efcdcb2afdac3c406d74cf iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000002286ce74157e4ec49f6d564323c9d4e6b58871fa1f2b3735ad620ed9e2842e000000000e800000000200002000000056bc18dcd8157c3c2f28c65ba18c84939674c5211adf1fae0ff7e784b9c6767d90000000daac0951463061b6814618370919b100d52b4023c6fad9582aea18e8ea1347618a16216ad43b8df54dad2e285875a9314b8e0a3dfdaba1b262a1c7de53edac02331c82d8e67095525298d0462fd2ecbddd032fda28cc23fec8c363f34caac16c2a4565eb24838675d318319dbbfc78fa1dfa144a1907905d487e5e78c04d9500dd8865351bad020991d1b9a939228a7d40000000eca32992479c16376ff2214342d64c9ee8197f1b80a4b0acf3616a5a7d806f716f864b60c67db7bbb7354eb54666361a1ec90f1a58041885e681156a2688a70e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411829082" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90381bdcd24ada01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{07A97531-B6C6-11EE-87B1-5E688C03EF37} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2324 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2324 iexplore.exe 2324 iexplore.exe 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE 2892 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2892 2324 iexplore.exe 28 PID 2324 wrote to memory of 2892 2324 iexplore.exe 28 PID 2324 wrote to memory of 2892 2324 iexplore.exe 28 PID 2324 wrote to memory of 2892 2324 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\679f7abf506a3762bb72fed3afacb5f0.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5631cc2841e7de9ab34be0b7ca28369f1
SHA16cfb1ae8261dd34b5572ad3f8941f32047f97fda
SHA25660ae417059429fe67611d0601051cf0db0ae8be8d19cac33ef6261d65b44c329
SHA512ca4837f87bd193d71dab15160be6a040433cb5f2f8de402d53511facb815b43b376050b87a7378494a4929d17b8d812808ab0adb12503666fb812f6cd87d58ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc66610bb8c158cc085efb0ee91a9312
SHA1dde771d4b597e56e93e0ba08eb34636bfa004a9b
SHA256e82a62ed36e3f59e232dea1c843994115014210f8028f217f9c3ef69e6e6f6b2
SHA51212c895cc49cf631557ee9ed3221d33dc6a199dba11be56815bfafb548a175f84c59c323f7b220b6bd9fdfadbb934f9f318ac33a6658e0b50481f6344a59e25bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c6df8ae65d9851ef7df0477ecbd9838
SHA143960c98ff57ff5a599f8561d856f37f86a0b4b5
SHA25642964748635a67d903abcd8f26cbc4150b9097d5e1f22718d0c4fc02863f6ef0
SHA512ab455195cc272f59c1a8e8c3db3d6973258f41b2ab78f05ad96bdbc057add49d548c450c356b41ec0b369224b90ffc43c683834d7b47ecad8df852ee8631a26e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5a8c7ee555b9ef72555d79d123bba8a
SHA114f02e3e0db9fd98e98b17f1f368da0e582d3e15
SHA256bcaa39f4a6e22f1ad8f322bd4ce3239c21aaa61d10b734467a7de2262fc71cbd
SHA512e817d82fa9ea2c5ef1f1c31de3b60c24ac8c6ed142d12fad7658bb06e048bb282aab39eadc2e754c5669f29286ff30016c29591f30b2f00ad26841a3f9bc6dcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c24886ad0c8488abdd876773daae0f1
SHA1c10cec9d1013a0f29c9a9d4e5d20ecceeb2aab7c
SHA2560b0c993bb1b56129c187513fd4abf8885e0da48abe2be5a490a3f7f502fe48a1
SHA5125baf778c5f6d8be0c8fc24053a2a6b81a4c9b96958188135749f3bca4a463f2e6963d418742d726d283f60246a136fa933cd0add3aab078cee0171e3b18256bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5026225cdbbf8a03e95afd4e0bf576adb
SHA1d4580b49f44174ee599eb1084a027432ea69a3b5
SHA2565f8a8f2215988633640d39b18cc04d78740e9a68a6232232c4ef6748e4400284
SHA51235bc05afbc43a4d8b89def6e229f733f1f9aaeffabeb5ae602f248ac9f496d602c24a52ee97f9a6146da9a8147a0918e283bdc83b87003d7d7d2aff0fb374a6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5115deb25a31d6db0ab1b54c9a6e34ce4
SHA13e66721d9e67791c7c80df3203a5931fb65954b1
SHA256fdb82935ab7710b230f7c9bfe5b4a58af1a5429a0f3281bdd64676f237e91cf1
SHA5125efa6ce423746b41dec6fde9440a393275339793dc1914e92d7bb6863e3b841b10d756504243c1251a80e7d71b21c4d9a8c0c9c343420fa5711cb16c3d095584
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5a3bdbea245da6ad9240ebcad15822a
SHA112a90b6238d92d3b854d1566479475972ff40b81
SHA256d34a1005e17893ad71f19ef3bf71f28be5fe627f700cae0ac8fb2772418b91c2
SHA512347b3d70ba053cd7509f8e21d8bd9315f7f417f359b168939bf9094c29b171ae37edfc3982481c8e582b89145a3fa339dd2e76f96095578f87f2e73d76fbda59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bc2c557d9733c517a19ef021ddb7ea5
SHA103a6aae9de66c36761052583ffb9c4bdf53ad9b0
SHA25631f059886f21d14daf0f06181aa87b0a6c0e7a3cc6095f97c6dc4fd5d0f22349
SHA5124fa4b03d9df4e125af7d4b85c34881a71c26fb51f98533fa37f2bdab0eaed96d6fe027b0669fcd333563972e086bfdd771d35d0fa51197ffd14fe05c2947187d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d94c8755f03a4b05fde00d55801f0ea
SHA164fa8bfaf9c8764edb83e12869fa9528d73632cb
SHA25614eb2307741b0ec050d27a6c71ecdd6d3f177195e0a1f467195dafd7369ffbcf
SHA5128ff131dac8c5bb2e9792eedb63463b112c084a078ffaa49ef941f2928030928de5639b86593dd6220ad0e2de79beda7307772d5ca17d9eaa334d64742cc4c0a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc6aa42a9139029991688ccd43c547e4
SHA17e62f1e36f32399453066f1fd57bdba523bef0d8
SHA2568af9279741113dc68193f6073d8ed45925265fa3de83169565735504a4785b71
SHA5120be87c41ad7321b8e6253be50f80df368c77672340cacfec219019cbd169108ea073b6f921b2be1c3c5c25360011ac6b8cbd341948b917ec7f64b924fba6b689
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519c4e4710da7e8fb162d6f92e5c89f2e
SHA196c8f45d785d0bcd4e91504e9406b0ed8817fc34
SHA256f2a4ab286a446baf745773d18992107570d2a5a5f2e3b72785555736a69d2ecf
SHA512dae624778fe3e6811856e0393f4a32f118e5a0ce5e47983805cfbe5c1acf06efc1413b18b99da65d8aa3ef3079ffd9a7c7880c44713542ac6aabc82a3c7108dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590c827a31cf96b1b22acc3cd9fefa266
SHA1e983082cb7325a2a579f6b64e8b33d3786e3a431
SHA25669648bf61cc860e485855f099a0a638f31daf6cf6ab858ffe37969cc094f3028
SHA512f121d4b68c6a46d3790184e8fde9942b1f3f890ece9e4c7fb294dd33c2062b44ec4da2cbdcff6635997d43ee8237bdb65b26181a2f72785dbf3f128962dc81fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5918922b319aa24ed27686ac4cf1a45f8
SHA138790412ac80fb64cd549e7ac7bd23181378fce3
SHA256ccc98c01b8e7a098e7a00c98267f369cc66547572680e79d6736b775ae5f771a
SHA5126f8f5413c655691778161508c12b9e1dd6affb61e5172547a85dcae54525858a71939d687a8b2e2591a92ec6f5cdc7e4c295d54f7f60963cbde6e673abb76a4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a2c13afa4e0b9e05213a26144412e3e
SHA1fc3fc263dc2509d02e13a868cf6d301f989c2121
SHA25672b34b18035c0f3d52e796d7fedda3babbcfaa780df15e5b96d652355ad2d98e
SHA5120225b6fa4a9f902fe5d49ada82000301e395b498cbf0cb9b46eb1fae3a4efd8c49b01f7004b90550aa018f616619e50fffd1042bfeec7b57459e32efac1aafc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539a35459e256c1cab8a6fdf0acc7a121
SHA1abd2cc2096a1f4ff980007b3800eb4c6217d2a36
SHA256c6cc62b36015edeeaf7beee4ff0df62c0969ce5f3111a5cf1a9cd39f38805f46
SHA512ada119ae086759b1a99e9ef9f19f4de088828aee66bf32de45e4f9400498f5b3e3bca4908e961ee5520da07e5f95cd3d65fb95839d262e6575179093b4d585d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d6fb6131234898b5d16372d23889a99
SHA113d955d89e15495be5e79f854ce86773592e51e3
SHA2563ff7d30c3651ca8ae1ef988587e78acf33da9df6cdfc4851db11c12297a877b2
SHA5120e0c274f49f701c3d00f9590afdc515b4ee0dcee648f4452c5538d24d0ba7d5dad4707979390faf3ae694f5e16efce2d5e843c24054cea90dbccfde719decdd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a131dc625352e9d4253b9c09be24d14e
SHA1b8de770db391a7ff830619c44c24a93ed1117a6f
SHA2562a947a933458ebcb57a1762a5fb503b8dec200da602be1570f38af8659550747
SHA512f84f7cec232b8c31bb0b11be72db2a6141c2af937accac5f79feacc00bbf2f47083ba4c60ed47780e8157a0dfd01d0ebe7b8488633f9bc83db380fe323a8fa06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f32425ffda5d1cb3c6395e617946c20d
SHA19915aafce8873483a5b6d5e4dc82f1deef947188
SHA25681f90098369a70fd1d66484a351e74ef889e141793020587e805f5b8d5ae1e39
SHA51257b19c52bbef18f4b4559d4c838a025ccaff8e28d12451b22d759750189dbce6cc2a041af21b4f669f4f0db9cb05ff7d92eaae0f93ae66097751e0fb30d19352
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06