Analysis
-
max time kernel
137s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24-01-2024 22:01
Static task
static1
Behavioral task
behavioral1
Sample
72f584e10fc6feb1faab8acdc6acb9ee.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
72f584e10fc6feb1faab8acdc6acb9ee.html
Resource
win10v2004-20231222-en
General
-
Target
72f584e10fc6feb1faab8acdc6acb9ee.html
-
Size
5KB
-
MD5
72f584e10fc6feb1faab8acdc6acb9ee
-
SHA1
899e0f9a45f6e52e1011f3810f48317eed496059
-
SHA256
8e62ffe770af2a99ba78ae0f83e85b045b89e77c9e5cdb30a5b20d19022d8f55
-
SHA512
fdcf9520aa8c2934f68f9236b3121e286be69c7bca7d45a959da2f3ea71743cea8dab78371bae6a67b9c4c00b0a6c786c3f907fbfb4be19be108d73600790260
-
SSDEEP
96:VON29ZBfpOs9ihyvpHRsu0T22JzGxFvtCDSUlrkytVND4VGHe:VO4Dppiy2ShtCOsrpVsg+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C575BD1-BB04-11EE-8FC2-4A7F2EE8F0A9} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000002b62b54dd5a28507b64740baef0b03999b61508bb0e5a7f9fb4a9c42b360d3f000000000e800000000200002000000057634c35348f5dd7ccdd13a9e935e0fa37f553336330ca12aee2cd51d80cb7e8200000006776e8b2c15030c26757e82b009323ce45b137a050f134c8e56d8d8b68af6de840000000c9c7c06e42c9ebbbd0cdc66b500fed8b98295a6c0cb2b2793bd41ef83da439cb1162885b404b586fda393e7e5512ce88b4e92c7df3eef1fc4961d4b76bf7dddf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b63c40114fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412295577" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000d1c06dd3cd6acee1f299d38fd879fe2dba8e3d4e35a974bcebdbe4a094be9d22000000000e800000000200002000000077c5e61f1085d463f8a487b039a4a4e3b1cb73f140e3c2cd21aa0fcd0bdef16d90000000718a7209c873a42382ca2b331467dabff6d23c96310a0327dc593a680c2d0a09ad12e9a738b8157a886b48651cc4c22bf1f20ffb2a1d2ad6a4cfcc2c0f79143ebffd4fe861a317439c604940e59611a0154ae9989d288864b3c37b354fa64037b6a95df9dde7d4cb4995ff0c3297d7dca66dcc15a0504514c8a09f5662374ca1bdc838930af4a36769ebd973d2f976b740000000134a497b8f3829c20fdc49b8b7d8a7549fb981729315e4f413ad36393587c8153e5c875042a11afe3a2dc3f45143fd174ebddad529d186421259ddf33853e934 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2800 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2800 iexplore.exe 2800 iexplore.exe 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2800 wrote to memory of 3040 2800 iexplore.exe 28 PID 2800 wrote to memory of 3040 2800 iexplore.exe 28 PID 2800 wrote to memory of 3040 2800 iexplore.exe 28 PID 2800 wrote to memory of 3040 2800 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72f584e10fc6feb1faab8acdc6acb9ee.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8e611fa338df06f5aa9120892afcd0b
SHA18e973c84e324bd5c6ad2819a217a4c0645e42027
SHA2568f44c2cf332058599e1374615f6a29eb38899bd44f0c9e2674f9f794aa3ef949
SHA512cdfbd24dae0e0e6fc80eb15ec73f2a7e50f5ff650ed3683a13be1a384421439f57e9dc51fd82ea63f34c59a00baaddb298263eff619d6527ffe9564df23b42ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fae26b172ddd08b6af23f55dc2b2f42
SHA1e576d87863326e5e820383306745bd9e2a8263b1
SHA2566ec28d3dc70350ebff764f386f8aa41588a72d28c41d822bcc5a47ba72e78d50
SHA5120018085b74ac9928288af79358cf5eef78a38d0b1655e6c8a5d7f8d0b02c18522a44ea3651384327430a7193666f3eb26b59d9afc3db8d48637df53b8a857701
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a61f0da52a586a75dea6c3ac9bcc9f7
SHA1b593547e2a5291f768d7c4f39326901d3eef9221
SHA256f48807e947af281eacfa4e856b6f0f1d813583da9478c8bfd31341a4c8d9dfe4
SHA5127cba7292e17d0c91a8bfdeee3d3affcc1c758a0a011644bf364d463df7e31374e9e0b754aee7b27ce69ca4fb3f8c1c568657be50ff3af4d6940400af5d56adf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5847e1228c69d5fdff4e5726e79e2bffa
SHA18dc530de65fa61d915664b55bfd362f5fbf4c517
SHA2568762abd23278d3d82e638ee90cee7624a60981277567fa980b15d64a9c1dc126
SHA512c5d342fe3804a54526c7adf1c0d24655df4a30cbd600948b4f6e4da1b4c56c0555479d71aadc75882a8128f570f53afef23a1de2b96493eb9d14149ee8444452
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4f38b3929021f2d6618485d092abe78
SHA1b381b0decd3f6ff19f7a05bb356e86f1734d6057
SHA256207dc5f4ce953bd5abbcfdbb1c7d4a5cc9086806628acc3b20465006287be42a
SHA512580540fa43ada644f8d4d1865ff337ae19fdeb74ea2e843315345b7583b788d9348cd644ef5d248b6ad05e0414a7095bc8c1e8affb5b85a45536c6ff0a9e53da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b11fb8ac4d96b15741ae1a32d830d22
SHA1e739fafacba9a6ddf4f53c617ff50ec35421b19d
SHA25636f3ee3076e35ccc3e3e71a806c6b029b433166469fe5668cbbb331b7e1538ad
SHA512b56daf458ee272ceb28f462eb2122caa3e9b7b443fb0a041e9c5017b535ed4c0788b6dd4fdd3ea77d414656f5104bd9256c0d0e7c7f75bf154746e803548c00d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535b6eb068f9c1f6f74197784f9533898
SHA17ee7f6baaaa926765fbfe7851ce41c145ed585b1
SHA25651fa9d4b252873a079859b89750504e128ae43037b8360eb1f62a57a8338781b
SHA512eb7244912b6158cecae81ec948966f61120a8dca91ffe8c33ed73dba9ace286924be658db48814708a0dc451bcc98b4c79a01751604efb50dc06ed660cb28eca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f5fbbfb920e19c38bf5cad0aafbcbb2
SHA1405a5d4d7b5a74ce2f69e4148640582dfeeddb02
SHA2569244f41d67a11eaf8e233c09836af465ea6a3557aba592b2c733b0bce626e084
SHA5123bbc64a61acf06475be429e42a59966d3a286bc00eabb2cee2c11ceebbd435973a3d20fa2ff26b96b059f8bdc116761df92525b9dc50d81b95f4207c5e82f3ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a00fa2b3562c0d24b005e9d6879aa71
SHA130b59209577b33a9d158ae15451cb9355a00880a
SHA256315694c4f7aa39114b4feb7b7fce835cb5d553e992845d6a8d4b581c4b2ce733
SHA51264a67bc7f0534600fde67ab399ed1e405df118b021dd0311d79f2006cf37e0f20b0390b107448e201f6789e277f51c9a20364e2bbbcb977e403a25506cd32946
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bf393da4cc258dd5f55e9e8099ef334
SHA1373a0bdbf60c4d3000241b388fac2571ba7fd7e8
SHA256b9ded4cea3c2822d6a682a93c1b923041a92a30e876ccfd31db9d8c7f4ffa310
SHA512525b40e7228ee63f08172e35e929d31a0d9f3d6432a28266845bc8e05a9f4b0c7e880edf55c4e24f3029504a6ba70a655005910024be5c9f2c8f16cfe6887fe8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508952678357fc1b32d35b00c47619cd2
SHA1d164593848adcf61222b1efaf47af9755dfc97ea
SHA256961d6cc225020402e87d6587c455b9dd71082dbc0a9903f31839a388042abbb0
SHA512ad3d077b4b4c8bd30e13ca5f71a161f0d771fc61cc20c0d5fe9c8e3edf9d2b1f97fbffaf4012a248fa4237f5edc1957f032572ae8b450dff5c9bfbf459200733
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a717cd9654a1b32330eac8d4112c7c04
SHA1a57edefd7f9b875ef59a2db09d38a47923fc5ef9
SHA2567718277aa6ff7b1c5fccff50110f5af60f7d3670dcfae06c44e37760b62cce42
SHA5126a043255b33773107d3cc963c78ab4529a4f6634e94af76fc0940a35ef1e53d182e3a832a03c9de9b8fe723fe1598101d32df37787897b6252d6a027e901a8fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6e6fa6cfc507772975e4dac4edf57d2
SHA168aa6853985a11e3a573c91d235bf1afd6f73966
SHA256e95964851592dbfa62cf6f93adefbfd125499511c06f524e4480c8983cf80ca0
SHA51250ef507999522ff45d6a8eb34538f596a51bfa64fbd9e2f9532ac4ad3639dfd6af426719a2ac54cf1214e04b5c49ab6cd02561165d8bf248c544cb3274bb098e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf6bec9c4454da0c51aec3ed2fc9c3a5
SHA15c9a58b945dbd8a11e0c1f1c6250595bf2ea1fac
SHA2561ad6be4ec236cf2a489c9774acde30a49dcac93631d5cd6b66a3a5214f6e88fe
SHA5125953ee958a872b60fb5c31e3f0a365ab2fe5b205946d206000ffe5e27996234dae554d9f24d415991ad623f5487093224752e4a2d8763393cb7071557e9876d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575460352ea984a3e52bdb69e72388165
SHA1b0048b64379b3a0c9c2dfe88d5869259c2092998
SHA256e9852c5e3addda83a0bb4e99e1e8e11fa3bc0011d797c4d4eb60627748546c54
SHA512febe4de8ca3561c6149c8a98ad0eefac669e0411b279065542ae34d1a88794c96cbed12f61389bed800bbb566ffd96e33eda4f2261ac52e20312f8caddfaef19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5086821366494c7d99b5e26d01e2bd7ba
SHA17f8f921503ced16602a94bee57e47eab80439b7b
SHA25608141fa8b52a61626e0ef3dfeb22c0d1a1eabbd42123c1218574ce2bf8fef1fe
SHA5124dc14124e0c235049d76f72b5fc4844e0e6b0ae80831043ccb9eda6d442ea006e3b465bc2266912b70349364033351c500e7ba479b13f63f6b52883d9f566ffa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51caa3d7a7f4f7802a07df9ae5543fd97
SHA14a4d976839f7c779f6402422ad771915d2a38c6d
SHA256923495737a1ba03dc0363fddb08baa5873ccd453ffcb2e35e1d72dc8bdbec353
SHA51280ca1bf346218004c9599555eae97afc8e86027dada46a01fc0cfc07c617d3ea5d40b2e8fd0b71df210d3805b368c5a2deb5bb4b34fe1c300fefc66cfcba2260
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b6e27aa789db335b1e747490c7ba8f4
SHA1068bd17553ca80abf53df39812f4fb5f6ce49614
SHA256bbd7f773a6a3e516bb4430c713278c58da2627a2150043d801c08697902464fa
SHA512cd96657911bc451c6c37d90685c167a5dbc900fd872cf487b494317f4c8c9010aa80cc3e8827665fcc4c340e1981f961fb4e429eb8db8825ced538f8643a7fb2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06