Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24-01-2024 17:49
Static task
static1
Behavioral task
behavioral1
Sample
72a940af99878610b372f930de6e9a4c.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
72a940af99878610b372f930de6e9a4c.html
Resource
win10v2004-20231222-en
General
-
Target
72a940af99878610b372f930de6e9a4c.html
-
Size
6KB
-
MD5
72a940af99878610b372f930de6e9a4c
-
SHA1
fa9314c7aadab54e90466e0741f9439f1660c567
-
SHA256
e4de6576dd358f77975247228d9fd9fa4546bcb388384f5ab0aac8f0f2c03c4b
-
SHA512
7eaba148fd3e9c84d90121638b3bb83d92f93bc9f223eb4bd5abc33d8c3be04bd83e3b92251efd53586b61327e35087ed32d8ac8aa86a54807c64a1e5899608d
-
SSDEEP
96:uzVs+ux7PsLLY1k9o84d12ef7CSTUeR/6/NcEZ7ru7f:csz7PsAYS/B4Nb76f
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000069390a88db81e5af681016f66e52ec81bb560d963557f1a071b648efbf36cdd5000000000e80000000020000200000000dbdbb33ead6e5231d99784d1fae342ec5c229503c84cf5144cf414e783a11462000000053c1d03887d51462afb255357772afdfc388f6e7e22b1e9037810526747f853c40000000dbcb0f22e76d0b5f0bdb20b44f5a8925419a9da8a8eaca45d676dddeb82a9574e4abb7510745fea79e7ed1907d3c1b788592551ca4ce0d6700f2eff33ba0a919 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b030a3eaed4eda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000dfec26ea69b43bbc911a1adfa5c0bd237c16b1103af8224dc52c82c0b066e5ef000000000e8000000002000020000000f2a7bd24e6a338dbe66f49b37323d3baad85ef817dd7b5a26026756f8d3d95a09000000005bc5c9941bf88b5a5d0e029448187ce621901c6b0f99638ccc6d4d34c76df913c0aaaef989f177cca61a5c0471e034e1edab129fd340f5919054e477da38f9d5dbad2dd42a05b775a48c786b244cee364f248a1f1bd77e1c01428585fba79721f057c395127782a616d8b46b0694ff0496402949691bbdff618a79368d4780f216e772b88e94feb944152355b129986400000001fc52759c3cba8d8d1aed57de617f37ba9db90c225cd3d429bafaf1ffc21407055f6d0dfbe6307114fe9e281798ac68b894f7afc48e8363d12f6772fafdcb4f4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412280466" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FCC83D31-BAE0-11EE-B9E8-EE9A2FAC8CC3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2252 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2252 iexplore.exe 2252 iexplore.exe 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE 2084 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2084 2252 iexplore.exe 28 PID 2252 wrote to memory of 2084 2252 iexplore.exe 28 PID 2252 wrote to memory of 2084 2252 iexplore.exe 28 PID 2252 wrote to memory of 2084 2252 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72a940af99878610b372f930de6e9a4c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6d2ce023f30c7327be03de82ea80075
SHA10bcdcb624907e18e30d83f59c18aba59c16ab746
SHA25640d7181cd961b8fe4e4ad313eb91290e1c30fc845d20de20bcea023c51b720b5
SHA5128f71f955985e9cf3d7e5705ed2deee1f855a56c798ecb90785ffca068d21351c254bf16648d922e50b7236c509fdb31e0340437c53ee7d1ceee0e83bb4581b9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a78e2469984b709c3e833f2725989a34
SHA139d7651094ddfdde554c36517b4ec5301de8cb66
SHA2567a726313c5bf37ccd19e6be41a11555ca10f895587fcd6d2a405ad77f4026fb3
SHA51298b353352e801cd5463661bfd7483538ea5523df119b925f6eb277191d2953c5706382e6cd2ee27c85644f80b87f3cd15e4095bb56db5c746b71b320b3f12543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4fd8b3f7906c365480f191141c0b4f1
SHA104682d87ee3f1a9a954287c30cb2f57cde89b079
SHA2567907bf616ed027959e4de42a9cfd3d57035da18498056c6be83b1791c70e148c
SHA51205ce9ab2909b52674b8a2f44f7154dc0a91898efe4117ff7d2a9eb5373d9913a2e0d67a6b8d48414a645c69d484771703476dab10f5b1caaca06aab9a0008be5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ccc692ccc03364dd1198cb8a9466270
SHA1b5c18a6b1b883c7cc757deed544bf23f176f3c27
SHA2568d073b444182cb82479872d89a6f5cdb81a5d732d683f523ec0ed1b9182cc447
SHA5121ae18922458307abde57940053fe8e2fe0cc6f56c5e2849f8bc769ed00e2da117bead3bd8067af5c435e744941048b8f4455db63355295f47717a7436593e5a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b63c1e9e1a5a7e6d5c43c7cef2ab2fe
SHA1a25da85d07bd6450a96928d45caa4b279fc22542
SHA256f70e1e49023a882d6eb87222d3427a8bc41caaf240e3929b4da99a9cec048d6d
SHA512e20c36705aafa759ad81c9f67e68696ba05f02f085f4fb83b5c53ea34b4bc5e1132b0fd2f34a40b2e1f25a4e1562731f981c3f4cf5c7c99e4050da218a81ae6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536390457183ab414a8d5d77d947d8051
SHA1496dfa31dc653a68338ad854ac1135745317f60c
SHA2560bebca9daaad0ee73296a17ce6526ae5c4d65279d5385e08c99cb06f2aa689a5
SHA512831d78fc59ba21139480e668c64e51683992c93ff969f6ec003917f5502c7cf6ea8a084cfc5efa42e80fccb3b4a7860863319a3776000263e2addb6ee02e051f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2568198f562628458f1eac64dbdbf1d
SHA13f88a265542999d4e2908e69e133abbe2cbd3faa
SHA256792ff049cec222ccfc6cd85ec569694d099126083aa3e15022930bc0930654d4
SHA512e76a4228f651716f88a33bfb39011ce424089fa36643703c86cb3f090468fa304d5fad148cdc1d7e2e304c451baf765c0fdf2938fd8a9be35772e23fadc8ac1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59093370fc70815cc52df9e8421bf9349
SHA1ea60c254c2f26991bd27110aff21f9233d65bdf3
SHA25626bffb41d505c34fbf10eec9252b4297ba9c4524a32ea7c32ae5b91647281dc2
SHA51270df29722606e985132f74bea63cea7ab9d7f0bee3542a7b910a31fc5454ba560e167214dad7c9aa0adfe0ebefca53c5b1d31c45987282b0b4ce4ced96e613b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54318abfb64e7a8973930d1fc2cffc1b1
SHA1873657ac100ca301d4fb0f53a5150bcd614b5c26
SHA2561b8889752fbd8f160f609a41f90cbb770934016787782db690747438eeea1a85
SHA5125987f05061bafda98a8960227db3e1ff25e0bac809bdeef53ffde2456b19f4f45336d7ac56ec36465ea4cce4f3d658566621643a8cfe0219286ff09dc918ccd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e63483f95dc8606d9f15b61dc9f851d1
SHA1ac0e699c914a62caa2dbf5829f7ac2add630ae1e
SHA256bf1ecaef8ac9cfd04810fc6ad6467c337c10afcc5e5e7ffbcf9f136b108ef346
SHA512a8a24f5727a5a6c4f04b8f11fbde524094c90607dd3a1d8a48fe88378c87d13c8b5c01b1d2a617185a7fe84a1716374dc2cd28ef93adb57bc0cf4dab77ca286e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5820654d16cfa467682ba6929286d6614
SHA1b70e4df9b46ba6a30395bfcd30a4e94ed3377b4b
SHA256066cd324c3dbd4ef901441c163d3270b57222adeb365b41cda589c858ab440c2
SHA512fed0773f8061054f114f61ac08fc371449fa359311edbb7de0e18aa917e7871eb9e7451e3b33d8cef5f86295cb859b24cdc337d9e7163624e73a2e14c5cc379a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0a93d371119f816ae0fe04db801cc39
SHA142066b735903b4ed0fa7474fe99dcf0574af0506
SHA2561b562dad6b45cdb8e1611a4f7083eaad4f234dba6580a6178c156a2aa1a592cf
SHA51224ceb36db4cf970fbe58e6df07b45f60ba13927bfeba39df0401ee8084b5aa62383fdc4b3aa8c6bb5c8f2a8b5666cc513d49a868174168091233c19cbd2232ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564d756c674cba25381411eacc4be7cc4
SHA10f52d587bc9cf1bdcc0707673f89d118a9bd87c2
SHA256fb64a92bb9d297d254a7eaa77978a637583ad9a54e51339acd58c14961de1027
SHA5121edf68ccbef2a36a2826b0ffa1a5b9d5993ad7376f9a1b97bc8c753bfe17f9ba983468a4d580a7930d856aa3a40c262d201c9b56c9b7eef0a9d66c8ede2cf177
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f672e8479ad7d7b1f1b4b3be33b3924
SHA1a1db77fe4c6ae2f386f3a58f5ddec863f3ff0989
SHA256be54d0afb8c38e1aac4294c0df8293214e4352c990765c42b69a4fc9b6b57fab
SHA51295322343ac5ca1cd65b74e3490d9e691d3817b79410ef52a80ecd5964079516918a6ef1719cb05fe2fa0ce0322244f6cf76a37515f6f09e3015ee64b0d7bfd74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c31dd1d0eb956194d331d889d06ef47
SHA1ef8f79146ce7af02a13acf32f6418211d5f856e8
SHA256a4f944d53baf206e3e5850c9c21e036a1182c526907e1aa3fe228853e2125692
SHA5121b5bea8f68c97fb221f628f0731ee09d9e5ebe912dc4a6f9ea711f1e2903812cb2b6a7fedb46fcd6cade9db95a05e24b667238f2f021d0565ef78a5b82557af1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5978ba1e476d3fd2a8fb7673169a2be41
SHA1fd9747bc2487187cc0c766aef16895c7ea6a4cf9
SHA256f52d92e45fea532c8b8057d426496040b408de5ca6371e39d7bd3884b9c5bb84
SHA512e9c5681a8c2adccf8da460cd04272bcc4b19b805361f70e7a288143a6488414ff86dbb4095de67a5005a0e6e8ab49248c55a272ad64e0039cc504e1cffcad840
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c28bbf4bb72e91d92498dabb32a035ed
SHA13de857e8a580a06202ff3637be0101ecca375083
SHA25650532debe60c7a5a91e72fc2e4e66867f652765edefe1bcd443e2506e434d446
SHA51230627ed992def0c0370452f350743c26f7f08c3d7931a34a6b47cb227693b36868e6bb539d78c43bfa8ccf92f94cab5f158e2c8ec291360dc61a0322f7720398
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54674a5d95d3f48146d33251ab4c4d45c
SHA181fa5b13fc49d4fb3fd8181aa6340be4952ffd01
SHA2561ccba27abdb4e993acedcea6892619019e6041d9668a457b53b268161640c962
SHA512394b10481a48bf5a7e06ee52cab580f671e1cc247643168f9682bf5d23682d0accced7b2768f648d0b3c78eb701ca562b882c6987392062deace46fa1313fffd
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06