Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24-01-2024 17:54
Static task
static1
Behavioral task
behavioral1
Sample
72ab0603feaebf57c77ad1e3e737cd18.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
72ab0603feaebf57c77ad1e3e737cd18.html
Resource
win10v2004-20231215-en
General
-
Target
72ab0603feaebf57c77ad1e3e737cd18.html
-
Size
4KB
-
MD5
72ab0603feaebf57c77ad1e3e737cd18
-
SHA1
d4454c2ec1584e84c3856a35f56c484013a91628
-
SHA256
ce084678dc2358c00ed99374934f2416ff06007fa6fc606078ea51d359026f80
-
SHA512
097333a6c8ebb9eca7d269773dd88676026bf8bbe702b8f125d29118f4e1ce220835cfb9bb777e09b0249b282e8410457ab4d2c4520f65af8642d9704f82287b
-
SSDEEP
96:rf9seakGiwLsvfpFFOxUEZOvBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIa0OvBRlVEg9+g0MwU
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000016429d771afc1e586ddb7511275b8041bc6864a0afc7e43b448e128f504ae72d000000000e8000000002000020000000632b03a51e0360c2cda8fd48e120d683433b8dcc6f69bfad1d9d34ab66b45044200000004eafac432937c0b0dd308019bad02adb6e85a1badc3c37fbd41d02bf65c07c9c4000000031f431ad0c0a056d0734deea8acc582cb4e85d3bb2c78dfa30f9e10a90462acfd87e9b4e027e0611fe541c7c601ab394b19389c004606832e51e9f2e9fb8f152 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c069a067ee4eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000102f2616875ee561e2ab44d447aacdff7aa63c08edcb8b2cdc2db3c0ff931dcd000000000e80000000020000200000004388acd1af62676ff0357ae8654e1ea860641c0b13fad2ab1bd876439b26e40d900000009686e5d2e0ba3a7488203ea5e0a3a9be8159db3e863803000912385bc5cb57353f957ee1a205360329a14b55cdda07aa7ae59f51a07b84414b2f9a4b327f838ad025052a3be3982de5fe3cb6ded268b8fef4905e90552664e50472ebbb9a760137e8445772b07a76afad48217e671949ffe998df499e4413b91c0bad9740fb48d79502309ec1b45a39500fb4cf6d46a440000000d923343dfd0515ae5e9bbaf2e740c739494e729d89f5ec7b314b6cab0173fcb615e592d276c326979915af7307e0dbab0731a6d8bc53742bdbdfa2608e01b411 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{93140211-BAE1-11EE-9610-464D43A133DD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412280717" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1740 iexplore.exe 1740 iexplore.exe 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2248 1740 iexplore.exe 28 PID 1740 wrote to memory of 2248 1740 iexplore.exe 28 PID 1740 wrote to memory of 2248 1740 iexplore.exe 28 PID 1740 wrote to memory of 2248 1740 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72ab0603feaebf57c77ad1e3e737cd18.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5641b68d1b5b616087702ddfdcad3862b
SHA11927d363db0d100477567c495457e2c4e38eae0b
SHA256999e1804c7c534a78791b71c8bbaba3a10e49c6bbd9ff6f5ea210bfb68a12637
SHA512a908b15eeab9c624a06fd78bbb41307f67cd245026bce37278c27ed6d1aba18e4084cba77dca3d33d68efa9d53b46744a4ab52cc005aa57a1fb37e1127599530
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ba6f6d89bf62c12aa6ff2048c45a1b6
SHA114659a1641adb1169e2322ff7cad688166b7b28c
SHA256b0f456dcd4d5485f8f59e74ce3cd778d5b03e5e2732c844f2e9669fb9aa53060
SHA5127eaa50d41bd51354a37c4e171565fadaf417f8424391a9384b6ad351fbb67564fe3b105fa35a426d0019f35a03aa35ecc2d6dd065601a933305414989479ad8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52afae63f0ff7e1ce9796597d935916bf
SHA1d1bba159b025351cb2fc54b92969fac8ec200fbb
SHA256c5148e892d6acd45e2184e33293e9c554d0a4b64240a219e82dd326e95b537ea
SHA51262c532df4742a5b7b15a4f92f8623033863ea8c6cc981f717e5c140ac4891d9f67ea642fb849f02296680383b4d4df5f1984d6870cb51c8b45ecf4dbbe4454c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55927e7d7092cdd8ccb27ebe687ef8026
SHA1dc0b5d463e5f041097335adf90ce5928d1967698
SHA256e45dc0077bdb267a99f875f1b4f2d451ab9b50153e1a98dbca2353b3bd069197
SHA5123f78d9f7f531a1902119314a302b225306c93dcb1ad949c70389680e1595e18b57536133d88474501a168bb2c2348480b380213470ab8d285865827530ce620a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae08202409c92ba0a803c078a678fe2d
SHA183402fa78097884ddf4d6baaa121a192834cdb9d
SHA2565d94dd04b2b31144eccb5540a6e59a37b5fd8976b326f1a6d3a3e1b1ff994b68
SHA5123b5cee5560b8f3353608dcbdd8e4e5195a144bf9dd0df0b723e55b0bcef5ce9670df2124d152412f296071b1ae50679bcc23daf9513bceb8885d127f5f0e805f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5566d3c1660169c769249a86915d447cc
SHA10e933ad095efb035b7b708b19ee0bee03c312bcd
SHA25670b5956865df0e97ecda051ae8c14580726f65fbfc92301ae4aeef755e6cb3a3
SHA51201eb9c4a5595cce41e231fd47f95b2c1471cb1dc8374c10c5274aca71b3f08074c48a9a12fbdfa651c51b624a951d7bcf5037084f76198f967faaa90ea6bb883
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fccbc990f2cbce38579717f879c7ed42
SHA197906116a9ea4eae51e19fb34586c524089dd0a4
SHA256fd0e950181ab5165f76a368088656da35633ea8d6459ac79d1b87638f52307c1
SHA512718cd8475df30f8d918f07844172c330c95da970570e70e43b316f58cf67d3fad96b3fe3f077691470d4830ce68f883a5c44b5ca0659eddb5c1d4db91e9d55bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b21abe54f587623868f84791617e9acd
SHA1bb7fbce33f0a98cee2717b9570168bebf8107603
SHA256d35e888fafefda0b508c759fdf9a282d9c85df19adb14ec1be997128eab62ef5
SHA5120bbefb71d8cc0b5c49a5553f1920638fb6cd5f59563b37b03a55b41ea7ddec249334fb3f3467e4182da721fd519ef56b168424bd1b404be023e934a3c456fa24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eda363ba8c112fa3f0d11eefdfc25935
SHA14110473b83fe7f973969ca2368eec4feea8109d1
SHA256edd62644ce9b3a147878d21894cb165b97354149077884bb2ed9c4b041222d3a
SHA512b7b5bf4ba9d9e917c11cadcb076a60621c36477d262215ee8aad4883e778c6f25cde7a8445983f7ca529698b1ca38a32d6ff99177269648b8392d398bfcad5ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7c692ca5378c9161b98f4a12869d20a
SHA14eee4d53aa96a83d14659274eca5df861a910cca
SHA2568fb4f620555f565c09b8c5c0575f87a0eb1123cc3be136522a0afc622dc3b0d3
SHA512b80eb1f16a46dab4aa66bcbc456e5d18b07c8035a50de88c26446f5546ee3b3a288e00671ea1ef6203ece5116a8c0854d313ea18c16707bbf4d5d77255897305
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a2c563bcd0fca058bea3441c6531516
SHA1a1d32e345c037b5fa10475fb52abaf5e74a31a84
SHA25645fb396b40b5dad7524b8d1851ed0966b5b1ae23c8349b291ebbaea8bc7bf43f
SHA5126a9a1ec228c412958f72faa26b84441d1844003c53051f30c6c9a14c03a9e67aa523e7f2af26f3a391abc4f9b09b545ca4759978667d3587d3706f9c4d379489
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59294eae4e764f3350c1d3675d324a5f6
SHA1d7e900730c14eaf9226ff75b679d1e567d1386c7
SHA256bf3f77654d32d9f140de08bab01ecd36dc69bda863143137f6e7d1da536a3cb1
SHA512ce3a724e20acc74417481f57a75a5959f87c6dff8df26cc197742f16a4742d2f55a5571ae13bfa13fc8319c80cfd8e861308b3c3e306c4e73a299844e8d8e222
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517944d75879d36a2843d85fb15cd3d14
SHA15af73a5202d61a1bbb06bf6d490b14d610507d4c
SHA2569905812608ff08d247757595ca1c673b4892633a48078c1afe018c7857fb1211
SHA512bdf12ebc03148933722b4c355d49a0d99cf9c3ffbfd6bb66f7b213cce22c9e875a8226b64e47a1ba4236ca1a20f23493bb500bf60556e599086370c7788e066a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cde1a1094debfced75135fa7e3a0c12
SHA15458c0b476304faa36792bc808c962a3ebeac6c4
SHA256510bf00e23233658f290d7c7e2bc8fefd8d3147eac9287f1c38c72332da3ec07
SHA512849891b910c475dc78ce6163b7c6fd9bf780a180eae1d72aa7fc64cf76d89563cc5187b90dba75b33c072d17309702a18d88a0da69136c87767119a364481f78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b42dc0c7156fb57bb8716fa40940aaa0
SHA1522c8344f8571a04c1fcadac838dbd5aefeabaa0
SHA2565aa45f220d2a585941f134f37e3a0b59acf1dcc2cba02afc0a4d87c0a63f0b42
SHA5122bb273fe3f6689298897ad54151345ca5eace8c814dc72a8269ee89f0217228acdf13b4a67e2305a8429ea9ad718f123e9c6a52f1bc4240c55b104a775a88247
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54345c4a6288b72285fd7d8930284c113
SHA1b1c4f6e5b8ed17434ecfcb372129cd4a1657dbe0
SHA25673fd67497fee55968853a24ef91ce13dad31c3e09ba91e0acd04e316ba8a9e55
SHA5126b7660918480658de1b0c525bc085888e7cd08708104c3a6064e7e4429f439e438512e4cfdf49a742b08f2013e2b30d8ee7e7c98050105889a62add9d4fd8293
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8eb75f6372e40ac413e73169b00332a
SHA17da8ecc07395708048a2b5625dcfd075c485e8a6
SHA256ff3f904f25b5a84a15ed23a8249f28ffcf0f2ddba84a161c7d48c8cac1855595
SHA5122e7fa9d9ddef085811de54c9153f7f074e7781199ea2110ad3ec06844b18c8209a09d4ee67e38ef9aa2137ed4f0698f1bd242b6df8332755bfe229cdbeb88b7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5478658ebcaee540161622508c254cef4
SHA106aca0e48e87561f23885987ff27ae93026072e8
SHA2569ccfe7c5a1030d9d58b8af7d6aad5e65574b31157c7f1232ebfdbe3decf1e243
SHA5121248d25de9312c4f00aa6fe2b466d0c1caa8f1cbe050ac42a03b7135dafe02bd7f009685f645fe3f6741b6e9376aecb6588fa7bf499a21ab087436e9adf731c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b332a3232af65e54fbe938cefe1ed31e
SHA1bf774996eca9b8671b1fcd1855f82f916e2e7749
SHA2567e72c89662133e9e04a764125f1313f3744beb527d77d4c09e4b3ea58412e40b
SHA5124a15b5a49d679a437b150e91755cdb10c22a45c5ba49ac33cbb99817d6015dbc9adfffb98447b9976980cd00aad5aafae2ae86a73751f678ac3f5ea4f8006da5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06