Analysis
-
max time kernel
117s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
720824ce1689a2b15d8296fec777d2c7.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
720824ce1689a2b15d8296fec777d2c7.html
Resource
win10v2004-20231215-en
General
-
Target
720824ce1689a2b15d8296fec777d2c7.html
-
Size
7KB
-
MD5
720824ce1689a2b15d8296fec777d2c7
-
SHA1
d951397e776648655166c09af6b0bdd87a04aa6f
-
SHA256
dc5542a6f0e556571689b902ea33d70970a2b5edfcc15c4e728200efdac59a2a
-
SHA512
32890902d381e6184edd70e516f620c5b8df3f881f19726b6309ad552420c939c9ed2447ac03fac4b593e3196cd1189244d49957756655e71ee35ae8571b74d3
-
SSDEEP
192:qaZ+sSN9aY29LTpUEd2KhTUueZo2Gtttv1eQB++skmhHYNFiINuGVaYRQ:qaZTOqTpUEd2WQueZStttv1eD+skqHY0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000039a66e06d84c9ab1199ded8dbaa2d0bd03effeb9978a4509eea1e3ff58952f8c000000000e8000000002000020000000d7ba0de3a818e2566fe458e8d7b6a59b70b3c050e047955ac3d3f41cb98824f820000000e52a3b610b4c3911e3ec078a7432144010afce58033f00edbcf3cea2f842100a400000002216287dfd5d10466ff80d2bc32977365ac1991b60760c85a9845699e03ce89fd3f525d28ea6a79cbaee55194f2f30dd963fbe40a73e4aae86d9df1931b433c2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90759707b34eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412255216" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a0532c567c4f5e5ed3864431dccaa299a03442c5de69bcdd37ed596c2abac143000000000e8000000002000020000000a948e935ff7e72974f31710b6da711cc9b439d76238dff115f5ad2878a59088f900000000f2c43c9d75065fcea4147fab068d3c648edf2075b08630ae88694b0d92f3044aa3bd6b04ea51f36c5c97bc63e9b61e56784a2bbcba0225c89e28c8439b6e92a3a69da45605884d2830a1e98a479d264ee860e4a79ac30a845774f037fb43e06648986d6abae1fe6652dd390726127bd58dc6e73ad3826abbeed2e649194cbd36c03eb9b42941c03221cae8b161be9ab40000000f75df015e2d8f41ee214abb192e6e38e4f1e3aa27e441ca03cf254b48162ebf53758051a1a9bf2c1c7a40aadcc8469f3d48b6f95ed2ab356f6b7d3e6d15e063f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3282E281-BAA6-11EE-9D5A-6A53A263E8F2} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1888 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1888 iexplore.exe 1888 iexplore.exe 1980 IEXPLORE.EXE 1980 IEXPLORE.EXE 1980 IEXPLORE.EXE 1980 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1888 wrote to memory of 1980 1888 iexplore.exe 28 PID 1888 wrote to memory of 1980 1888 iexplore.exe 28 PID 1888 wrote to memory of 1980 1888 iexplore.exe 28 PID 1888 wrote to memory of 1980 1888 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\720824ce1689a2b15d8296fec777d2c7.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db5ebcf3743e641a92a004f78f1c7ab9
SHA11745ac09ecc6924d0c8010a4b328d0e0d5c5fd35
SHA256b80c311f91cfef733ef01da6b68c312b906d0c9c1063c119f26dd23f624576d0
SHA5120c22bb9ded6d0da7b070a67efd68416c6b3a5167422eed2c15fe83bea2950c87314f2149f47908d5650bc84f79d80de013d056c9053c4b17972e7d9d5729c2eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53417c66a0c6a00d7e5fdf40db8667727
SHA135a3ff386a618b607028b6707b3889f330ea74cc
SHA2567952557622bcba8b6c77d02cfb4d80cc3114ad2eb7d60e18fd9e5ba98e6c4dc3
SHA512e8a69681ffbc23c5ed22a58aed5dc18a13e96ba0ea8f4b89ab124e4696b30dfca34ec82219795860078da08ab13bf995d2026ab170bb65c92adca3ce6cb21bea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563104d5b6cae8e074dd5c7d3d132986c
SHA16ac3a3ffdb6143b34fe808f66e754c22c6c035c1
SHA25671f8a7039de041f17b678098444ff249a3c58385b4553e735cc0071987ae7eb7
SHA51220ae3ac836fe927eaf29eb3a08eb89a11cf407187ea89f246617ad929889d7afdcddc60126b6820759c6cf5abeb84854376c8838432b5e313b9182dc1bb554b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579515990605932080c01ac0aea71f76e
SHA137f89c7e7287032cfe798e6aa9c54012a6563d4c
SHA25695d6e01b90f209734dd2beba55644d1c5c72753199b47a80d5c8103b312fe25b
SHA51278c8e6ff6f140eeba41cc7d6c60ea9241883411a9d10a498f8936f49f0efe2dad55f637247e8531ce57a5c5e9e660c4ee0ed469ee4300008176aad2b8698b26e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a447c421adae10101c4b646cee2ac84
SHA117e521cca711eb80e1d888494c7aa5a33ffd655a
SHA2563f27d17cd02c9567f5181f4453eb645d16427877e8bd4abb8e0c47c785d9bed3
SHA512f8a7f83b3170fd3376763dfd9907e2310470fe391bc36deaacef34434db26f427887bbdbf21895107252e5e5074eb75e6681cb10c90fe84a27bc601f174b2422
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a12bd39f84c0c62fe9421d3805251d7d
SHA1a53692d49318b850018a59d51e5a8164b106cb43
SHA2567ad9d346a4b9c68e5768db1745625a9b309877eee6da0f6bd8d29eb701e26e14
SHA512547a9c440e304d3345207f715d4503d7a1b39918b9ff048e99c932dcec8d6e91a899cbdf070b85b330beeedfee0b35da419ea07c5efa92d6efc179501a32b9af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57291d7165ab37c76fd4d5279e18d2545
SHA1526e863c5eed8dacd05585a9e29047458f0eb73b
SHA256a3cca584e965e3fa5d2ac84743b129cdbf8f4aea14b88502f508d168d6aab840
SHA5127e2ffd4b74a137fa5d768cc41daf5a3c5360368ffc239df35bac34d698debbfa8908c79ffbc076eba935e7baa716aae5603b3987e5ff3b787a187af015a9b777
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573c1a3211a04ed11114125c891c85073
SHA185629ae7c1f3f61d26df9e4134f76a03bf834f5c
SHA2567bda30413b68c422fa4e3c9ea362142666c1c6196b3c2553a2979cfb4064627d
SHA51236171e1bf7dfc6ff474f9b342d49af1700735813f20baeb445be9e73cdd63f4ee266b71a930cbcedb9ce67f04b94b55df707f31ee882486311624c110cf9ec3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b98a12e5c60f863b6b41a8bf75e1f0c1
SHA17eea7aee5756a17c9383e907470f7fd08f4551d2
SHA256507b8f7d90f7c3c45df93a39480fb53d1b511b2486dd13cceb14f723d6e32f1e
SHA5120d97e5901c57866b1f0363442040da3c63dbdf9a4e9d4e5c2535fe08c51046ff44d55f917baee56a8bddb49f35b2d1d1294422911a2fcc021c0989d01ac5dfcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f25af6cd97045cc81935e02b2f01a5cb
SHA182c6762c5d30c3f8ad460a3971b8282b7f4736e2
SHA2561805fb71b2655d0f7c0e4cd5277a44ec878793897bf52166de6333022f0a248f
SHA5128e2c278da25154e29ade531958327351ffc7ac20f36612680baf57eb7abfd068590d35b07d0a79044f7392c82033abe8b2682d1c296bb947115fddf24c4a39e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a98d6485fe66cbbe68fdff093351d16
SHA1da8cf326ff88e4f19a8f4633ccbf15a6f73e9d42
SHA256851083a1be90a2713ef2d796de152be2fbefc227239bea74dd7791640a191a0b
SHA512f7326643eec50b0ada7ca23f035a4bbde517a68a755162347360612a702826d81bb5e60ec4d80b868ab0c8b12d5988fb4b8c32561efc9639c66489ce62e74b76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af0972ff355b599192e2c5968724b851
SHA142d4963074b1b2a54469c5d6f4d1a5254e490d71
SHA256462a8e80c25b681898b33c1d717627e102bcc0f7ceced46b4396ec9e7aac97e5
SHA512d464db6c544bd931310c143ad66be64ca498bfab214004aee93d1c4c38fc89a9b92ee8982747634487ffcdf8ae6c339883a99fbcad6e30bea817856e610d6d06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcf3067f4afcd436e980c1a1ecc11c91
SHA14585ee7f5c74ec3c83e4786f2ac1bb901356a8ea
SHA2563ed92beab619b8b16ec32b7dce1c31db0a5d127d0734efa3afc3c426626a0bb3
SHA512c5dccb3c00119c7c5ecc428909ab57b367380c0614b6cfb30c5052db4f51ed412f4c2a22e71893a8ac6411290c4cdb96af42f4e15b66f74ab0330330c1ffc42c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5165979b83da8852b05e689c18306c849
SHA10cbe8eed00903134d691f6210fb11b896ab56d86
SHA2566b2e485f49121b1dd730af2edb36ee564041222fc06223ba7e6a4c02ba6495cd
SHA512d670f1acbff904083daac56350af4cc9dc4e82d4b411f0650d7f9ab2fa88a1174ab22e5865dc2bcedb61ad5206dd08283aacd94053eafb4bf06f050ff8bee8bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58781db7bbdd941a631b5083ae928b84c
SHA10afc14afbe4ed7b1b9201a2459cf0e056eb499fb
SHA25680d70456a497f3e26a7b0f2c6e02204b39f9b94a5722e1074bc1255e8ce60cd3
SHA512d0c57b8fb534efcc76e244fc9e5750f21479888b0dde8fcfda17c768ff23daf04b718864f6078321898ea8ad273aa488f8fd4d50b170357ba33b8207cf7f995e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547603a5dfea60ebe6a641cec90fd582d
SHA1a6007c6c77053e78386fed845dfe44dc0f40c348
SHA256f2e480eae21d00128c56b75deb59e5f8569e140ade160552806f6f49b54c8f16
SHA51240e39d741789534bf5e683465eb11690b6601573ba61d386c04823b6cfc7556520f4c10b39d90c6e2f357e312b260a0f81e2112d4af64196b6ca225ac0fc4499
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58dd147ba28f654b22b8186941befc250
SHA1141015a724a0cf46c2a99076b8dfaf618df10c5b
SHA256fd7a6a3e00b053f9f31c9fc8f75b2641821b329f8c66bf081b9c13f09b66ce68
SHA512ea9dad536186e3a2accd260119680adffb9479737cb1b7cf0b8313aa153f6943a034e479d495179b838ed1ece8a9ef1ba8d5fac4c1bd6daafdd2c1b416a20da8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\ga[1].js
Filesize45KB
MD5e9372f0ebbcf71f851e3d321ef2a8e5a
SHA12c7d19d1af7d97085c977d1b69dcb8b84483d87c
SHA2561259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
SHA512c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06