Analysis
-
max time kernel
122s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 18:43
Static task
static1
Behavioral task
behavioral1
Sample
72c485542466d28777e2855bc82df626.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
72c485542466d28777e2855bc82df626.html
Resource
win10v2004-20231215-en
General
-
Target
72c485542466d28777e2855bc82df626.html
-
Size
452B
-
MD5
72c485542466d28777e2855bc82df626
-
SHA1
39b8101c3ee10cf676308a9c0f426e37f6907bd1
-
SHA256
0e6d617c9f51c865cfd8797574570659302f98f0ee94296712f40ca877032658
-
SHA512
3d424b4bee95cfb5ff60bd7ef0aa5e03436ccfb8cc3ec4b2a37a0ca48bf7836c0391bca0788ba38b080a723befd58f5b041b0c28b3c651e1cf28138db03331f7
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000004543bc90893eb98ba820eeebc51ee301328c3d3ef0d6104a5ae0ee816678cbdc000000000e800000000200002000000080e1c0444b78b7fca384704fe6906d8d25ed00fcafdb5fd1a999700b8e0d223820000000090d72b26888969801671d83ea020ab890ea5b610a3110bb1d9b895d8579cdda4000000042a56d309f1ea3ac33525a9da748731a8f3415903a172802bc64099b1b02fdd6bef1ee7034a2d1be993deae10633ce5ce260453c115a251bc3c08c76602b4ae5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412283700" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83B062D1-BAE8-11EE-9840-CE9B5D0C5DE4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e8b5765b2ce522c867849974b9f39a9f065a637c4795f07b8d06a287ab93c63f000000000e80000000020000200000009f58ddd7c727324966aeb8de7b8e443c712bb5b1ff2f96bb3b8d74c56165ff8b900000000fec98b0225957d241cfc7cee3506e2a50f93cf5a6df96637840182491f4f3e66126d186eb761d5c3c609f2135f53325dc4b16e1157c3eb8d8f288d25333c9086f99a8e13ccf8b5caa95f986b7ffeae9c0ece41c2cb24a5aca767082391dffd47c0e496de5998a67c84d3af3fc8851d50a129952447b24d35747d1514e74de5dc7c431befea6f68539530985bf81517b4000000006d46f5114d733aee1c413a350793d9ea2bb6e0af1847a7cb12b6744a14a35a7de2ffcbfc260b6a7ab261501e59bb3149fce910b7518e198907a800bee3f713b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e008ad58f54eda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2360 iexplore.exe 2360 iexplore.exe 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2680 2360 iexplore.exe 28 PID 2360 wrote to memory of 2680 2360 iexplore.exe 28 PID 2360 wrote to memory of 2680 2360 iexplore.exe 28 PID 2360 wrote to memory of 2680 2360 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72c485542466d28777e2855bc82df626.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595a4c92a247e845da42975f7d553f35f
SHA16119eb1acd37cc9af4981da8cc991708ffbd1d01
SHA25663729da070f2a276211237ad55b425595592a2efeb3db6f1c5c7e788bb841fef
SHA512de55b42d1739ec957ee072f652c103cfd498ca4070f296610bb604d5b4edb69a69665762e40da0095fbf492ca92bc2712b175a0e8c50da129e8f1cd3e355914e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb3cdc8746558e844dd274228d2b409c
SHA1daa64b997efc60f2b9b8a2809888c47367c68ea7
SHA256c8ac669c841c2ec3b6c88b14cb5917ed9e745461f3ad02675bcc72ac0468bacb
SHA5123b2dc64d71d4d4f02feb0bc269ae5a6f88f1a72bda5a64fb5786553271fccc561a57fdaada937f58e400e0c945da126851ed43cbcbaaf4caa80bef34f067407a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdb503ab92a65c1222d984113f546d17
SHA129b2f4cc49c371eaa8aa03887b4e0eb915ac5c33
SHA256eaea3c3ecf4fc693337b073b9a020c59647bdd3f938b05c6836e59b38ea17e89
SHA5124f580fa654980b0e4604945eb394ea0cd8702d8596eb045ce5acdb69509d92ed34d9c839c72e70f9a9ff904b409a5b2950f0c0409ed80bc01bbae1f13f97b1e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c4d88e623899cb75d7a162c2f7fbaff
SHA19e40f8e600fb98a0fc4e24c2ef8158e6dc3d28d1
SHA256d360c51892fb14f9d16d81bf2ad115160fe99062c1ae145cfdfbd5df7d7964ad
SHA512eb24d7dfb44ef207ff66a9ff031beae89da7c4b23e175927bdf113882cb79187a07dc70b05650272d5d5e62186f2cfca789130619e22e90f44575eaf7d422943
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586dc62e9caf5646cac196c72112c6cf5
SHA1d62b76fa426b5bb5e977cb4766fc648a282bc538
SHA256f3f712d4b77167aa829ff1e96426a9e8bd855b672ae1dbe9df6a14d4902b2964
SHA512d3e1ddec0e6c44d38b1b801aac5f46c6d072ae05896dfdfd0ea74f17749a4e4037ced6d594cd280fc022e280f94c90297c54baa74a83a9118e62bbfc554c5e17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58acc0498d77caed17dc778122b1a920b
SHA1593ab6fafc89dfefac08d8ce28da6ae9ee0b5b60
SHA256358d2ab85de00b36b0fe2995bb21fab1228556ebbde63ba13b68f0df905284a1
SHA51214530b786ecfcfb292ae1978e3a65440da514c5c8a4d9cfc886bb6873d1c1b87a5caeffd2fe5e5ce137d1a1fa15dd02de69024ca915eac4c451aea0003708960
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ccdccca0c0bb52939ef9c3da4d6a24a
SHA105960e56559388e2196c3905115128b623fce770
SHA256a9e3f1c8ecc48a011968f170c10ca8687c5b238ea1fcecaaef59bf5ab97ec7f9
SHA512ec6075d2aab2e8405a8f7c274f733b08be52d863a7c60cce1d7b698c20d7ed8b9975e11797cf53b6463f388784b6d5d89ae26442cf4a5ae4479c3156253ada02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5605ca17974182f1eadf7af1786b6d68f
SHA149d338fbe205239a6d8a6dbc66488e0eea3f08c2
SHA256cefc2679c68fd1e429e266729277cab121432f09512f0ab1f8b824b5b0c0a1e5
SHA512641d4e9a9d8bdd9b73455ec770968cc136b4bb568f2d5f019213859e0c7fba2760528d8a087b46888e5f19094a10f15a020c473ea7d33dc65d459b76d3e9a543
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53517a7f163b01a4c5acbf45c321fd8d3
SHA15e864c5b7a4a73af3a0dc3cd03f355f67882c6f9
SHA25695a88455a4b5325bb4412fd94b0753ccdc790d3bf4f3517af1380f30395ec7e2
SHA5120c58a0f6bca80cff6787112ef49453af3f1185fd1380e62420dcd57760a1a3a81ce6557228afabc29195f8ef0e8e55435d8a73d6bb67e50570f17df6974c3bdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9ca9724baabef635b3655eccc75e1c3
SHA13481d2ac716e0f0980f28a343d0334fadd6eed31
SHA25670a54b363062b8cdf7da3f86ac9d352686ced6216803bdffc54aaea5ebd68641
SHA512f83f97bac1a9ac283c89908d3fb18cf3187e440e16647b72ec108b1bcfdb3422b4f6488faf910ee66bf8f0522c82ba1358ab21721ead307c3128218364abb2d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec5c0dda2edacd5c19502dec414fc9bc
SHA1214c7c42eae791f7d8683e6df7ab91a554ebcf44
SHA256524d21fe6f4fd81dd9224f5cb3aa8a06e32f7d0f1a4d05581bd3d92c1d66037a
SHA512113c51c75bf9c11eb264fe3df983d2bd77e66d245de45156cf08f8ddad640b50f01179c9633315161c343edb4ebaca906f77f2e1929c7edabd01f8a356f4c996
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c86ad43d9e400df725e650c3434a8872
SHA1ff36a3345ebfe86dd63e731231b125d7b9a820d9
SHA256b8f59015c753c35f96d8f6f838bdd264ac505fafb32b797812d4bf93891ef37e
SHA5121291c0c451e8fcf8271fb4df37e3ff6c81f950e93554173e38cd7c3f39e5941a458033965c0a36cb063aaa5b968b73ad42e8d7fdced1c76f0ba80fd1cc36a5f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eae70c0dc595a3734a144574f6982ffc
SHA10fb15e5de5cb3ece06abdd54ff89ab7472e1a570
SHA256d64db048f69cf3e8e88d155d1ad665a8b7820ad1263acd0975c57ff5cd454582
SHA512718edf0d14d2fc6fc17e32e93ef725cb13937fb078b052797ec7b2ac7fef34f797573ad3c8bd1dffbedecf2f535ab48e77a405a7c2ed4e9346a4bd725739cab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c24f0d78f75b6571e62167ce6f2285a
SHA1135f2bd3c896d7fa75d7dc326c47111a2f316b0f
SHA256a11cb6a2436043b70f2630cc8e423be40ea3c4a6466fff4571ea2d62140484fa
SHA512d1bfb0ebf43d87ff31360dc79098bcc093bc607559eb85a44e2155328525d724ce03d8e02dc58fe1b7cf94e87d6d1a834876af98f289f13570669a3a30efd513
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a17023d7ada2ed6f6ee5259eaa22ddc
SHA19e40e6734419580d5093b4c5184ec15386d3a02a
SHA2563915b27eb306d35ff2b5231d7548c2e94224911ba17b843a81fdd32a07da4b49
SHA512e5ac40a6a052944a506e917158803c84d8ea07f9830f583532dcf5020ade4bcaedf07b95db3efb13d646fc2cd9e91e8f07f08537a9db399b6c3942172a370bf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e41831802492ec61ed8d8b5f9eea7c2d
SHA144b8f8c8cd5d76cbb3dcd812f05712e375df6fd4
SHA25609cb92bf6fbd1096f83b9a5dcdc238cbef25cce73a022f8a7aab213010fc25df
SHA51240554629d1c8a9a51b0bf54c5ae7dd2625c67fc244781bf4894c90e5cc95fe76b0c5e0d4010ae8a4a997b301788e1ae3731ea01eb0cedcdd7f219895406ce87c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536033fe2b2cb4d8e12801fa300070740
SHA1dc69819e06a3c8e3bf8acdd3bce7a2b4e0b4ed88
SHA25603dd0c4dff0fd789be05ac7861d663a1f6a6b32373a29dfaaaeafc3d60551a63
SHA512041dbbeb9ca90a56a31f880cec2ac8f2ab39bd3a0bfa14df10ad2f1b6be344433bea9dbeaada02892865411bba2b721651e35aaa8ef097a79b735d8b5855716a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502498cbaf8a3d978dbd74500501f7502
SHA179eba56d757d60194573c30d2f7f1ef2e6af5199
SHA2563582f04f6226f96801efdddbb653d7db10a9dec63cfe5c877808c7be53a8c6ab
SHA512a660f66161f6ced6354aaf6ebc24f997443b1f5982d26fc1cd9c6bb16dc13f960bd0a4bb1cc552d37c57ecec17dd8aee2dfddf0cf9bca88db6511cb3f649fafe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adca139f53376168acc434d1d718e1c6
SHA149571ecf44e902a95e81d1cd851ed489c050f4cd
SHA2560f568c0d55c9c8696e938a1f169d307f14862ee9c2d4d1d33651baf26ae0ec6d
SHA51258327722ab9b1e82c7ee590884247a59f7253c7389c7c40e201b247359a82108c7f246dc1ccff0074b78cbc2efc78e26afccaca8a2708b0758b15ebd7a71f9af
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06