Analysis
-
max time kernel
134s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 18:51
Static task
static1
Behavioral task
behavioral1
Sample
72c89b6942474a75e811ecc68693dc48.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
72c89b6942474a75e811ecc68693dc48.html
Resource
win10v2004-20231215-en
General
-
Target
72c89b6942474a75e811ecc68693dc48.html
-
Size
27KB
-
MD5
72c89b6942474a75e811ecc68693dc48
-
SHA1
d7439cca571ba0b2820fe00a5598474be964d615
-
SHA256
efce73fb0924e717f32663f0b41d5ab2f599130cc98f2a0bb446b26113075a9c
-
SHA512
e77618e3a0fe8d97d87dd28264a5d6292e6bb00faeddefb57be1b0dd61999c7d3d3fd1f444ab41542bea4dd872b160ef595f48aa5926f78c87c0f3d15145bef3
-
SSDEEP
192:tzOl9Lp5KsnqwaMPbAshL3VuLwdeZZY/aXVWK9cpOsw23Nok:tQLp5r4d9ds/3l
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412284196" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60753281f64eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000007fb2381236ebb1fee2d5be9bdff51326bee91afe78e3b93201fbf033096c0000000000000e8000000002000020000000f2b5e89204cc2f9e1b8c8efffcd70e7e43247efad808da18b262a59fe1edbaba20000000447fa854031524189d1f62aa19b6baaa8b4779d8b3d3981b3cb75712864f13c2400000000da9fa2f884bc7cef70637a1d9391789539bc736fd2ffefe474ec04444dba5a9c4634a9c1a98c2d3dd3b79b4c3c2b82b37e0fcf2098e32e42d0d68dce1ea6847 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000eb7593ec39c9656a700777edd6949121e8cb14d07c7fbf67ad17c78b67991597000000000e80000000020000200000002b9802d17e928b1dda0fd2795eeddba94096388439695a84b77aad87ad67c6dd900000006b888e29eb3352d5af2ed22003c5b8d5154bb6a3731c185803662af918359b0f5ecf8bcd4a77173b4c04b359ac95403aafa691660aaebd461515b95e7c89034066df11d16aa78c5a0abf5f9513718ec3fd907ec58d11f20fad2598bce0bddf90f27abfa69bc94fd1fc69a28c802750c29d65402e73efa85ea3b85bce81914903e70680530cdcd7c94bda0607bdf229ee4000000045f3fb261b35492782e2ed78b4c626d2eedd5c23d5ee7993df3ae5544341cdc8dc51bf59c5cb8a9f63523c731e5b3bed59698f7bf983ff4be9e24ac8e9b2a3c3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC928D81-BAE9-11EE-B578-EAAD54D9E991} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1472 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1472 iexplore.exe 1472 iexplore.exe 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE 2448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1472 wrote to memory of 2448 1472 iexplore.exe 16 PID 1472 wrote to memory of 2448 1472 iexplore.exe 16 PID 1472 wrote to memory of 2448 1472 iexplore.exe 16 PID 1472 wrote to memory of 2448 1472 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72c89b6942474a75e811ecc68693dc48.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1472 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5baaa7c1e0ab1130485b2ae9f3188e135
SHA12f8c6cde4c8b5fec5060a96e10ca4562eee3a52f
SHA2560e7a0d2f9dcb33786abe1a3f3d34845a1351c545c79ba765ef736aa9f1281818
SHA512b4b5422dc436f103123fe1bfa9d38849d00411102c92b3706816d9561c19e573bd03954eea04fb591c83013c30adf5cb672b99bf739c568bdf02557adbfafa50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ceb7989f8ffee5135985945c8abcbef
SHA1146a2c964cf861621892290f51b42c6340d4d4b9
SHA256b544908dfbd207e27071dd323730c2ef71c1f3966d092c6c44631118f5955662
SHA51253f053f59a277b117004f13fd8b8b8912df3e1f5151a192614a63863225efe6ad2d8e7a37651a7291257a1662a85a148647a28063b4ecd690f741e62ff22e11f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d86825234d875eda2bedb70effad8167
SHA1a9fc5af76bb7417a43e5265bb257615236e62a02
SHA2566f6d75cc7a207436c002566a82e479cf7aa7b75e85f2d8b91a035f7325805b03
SHA5128d6c40314bb228ad4aafd3b5b162df96b6438fbf7bcd6aa2cb1d7a65e2defd39077bedb6a59f576244b0b382e30f1f469537da64911ae7d0fca9910117ff33f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589f3fb9aefaa3eedabcaa67ccfe4b38b
SHA1104493f00cc1b2868194fed489a0a28cf421271b
SHA256f59d155b3a1f0e2c0f0cf68da18835cb373ac9dbe3e7fb2c83793be1943a4156
SHA5126a9439a7f6bf10e83e1c50edf9f817b5f6475ba789288e336f10c88c24243d7081bc1dd75d9fcba1bea9110ad2458a7d1306026714c2e24e2c00c6436e9bde69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566463d31b08b90ff158465adc726e6b2
SHA13e6d84f44a79feeb8239b50b7130ed53298ea4cf
SHA256d8e2b1374d71710f737c86af022112414d72b4b8aa2d8cccf31152f6e51c4d09
SHA512bd3f6f88c479d82f6ad662cff33e23716d847cdd29e4df9b208185766aadf7b34c5d984d500a10caa9013741b047efd9d6828ae37759f573afaa742c264a1d47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b3488ecc60005a535dc7c0d4d419cd5
SHA13494f5e72f2c389cdf61f1032a70dd2d57184143
SHA256c60957f9a40b4b6e47f410809008cae7e687ff0c77e9649e5b03da12029c3c1c
SHA51273957ccfafd65e99dabeb67da8cff79f304859da2f2c78528298dd5f9122d07e88fc7ef1fe15d2d011b3e0e1af9b6c13511f61efcccfe43f361b4d2d26b29e31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d66269330ee2d18826cd42ebe9e52cc1
SHA1772c6be4f9fbe7abdfcad5729912ce77fd0ee8ba
SHA256a1b032b7cac55e609e62363b13d4ec55444e8f92e648c87e178addbc80595066
SHA51210ff66e444a8838ef8640d8bb6a91f0be6a47c14ef3f95af5fd92659bc8d990c2de490070f39b0e10dcfd5d6ed3371aee135cc426a446fba20e06ba2bbe406e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e57fcb711daf82c60e57c55c8dac2412
SHA11fb2a90055ffa7dad8c7d5c8e92f9a8629b53e9b
SHA256f3a2eca05bab726f8fd03189dafecffcc348e48ed80afe10ce1d389edf4c770e
SHA51245c5a38cd2628241ac34f16c8f59082925ded8d1af4ff442fad5711a354429dc142edd65f95ee94d495de5416c7c33ec66137894db0fad31f32efbc85f0b4922
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5178f24b1c4b4ca1d332f9dfdb45a9550
SHA1d35d089a444117466f19ca4a24dddf27b3b588ab
SHA2566e919160a33174a47c81db938f41a50f037df2a7c2ddb0d286e27ec933e6aec4
SHA512c8f38bbf023f0a09b49bb1a8abc496ede86649990190e4bf16703dc1bd7b1d3247cd45f3d5f1f3c4de8aba9edde6724473c4e987f32dae88b90ac7d34fde1ee7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57167979fe2af8e0520d019b26f3b1d18
SHA1cabd2b304429b1205a8483efed3559601d1b2850
SHA256938e3e9fad7404918317e59538abff43e04a3a82fa69fcea18726aedb18373d0
SHA512afdf6948b516a1822f4eff68e61686452b7a82f18fb2177c694891b8dbf9888cb2034121753fd946f6a9ab410a7d30469c615a33cc9ab3ebee3b249e52666d91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5505380fc562cd64a4f0489845110b0
SHA174c710f3c28174bfd24e3fe22968b4afa0574f2f
SHA256b0dc068bf70cda0051f618d57aaa142476beae54d291644dd6a1923b2db3ac6e
SHA512b25fd6679aa6c92cb37a96f01c50237e322f98672066a019d843f10ae098fafc3a14284657010b68e06764436dc520d2eb5b2b7a5cb9f28ed1bc5c865a9245cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ce1b31916cf4261518c5568cd991d11
SHA1d63308c06d66ba79b8785beb64226322a0f39e78
SHA25666a8399d95f7d36e1c55699498f8544196c4adc548ff5d9d4671d814aaf9288c
SHA5123af4ad0b2583fa7ce3f812596eabd1db2f256841a37e4ced4a810c06520aae68940678bdb145495951df0f74c62485f330b365dd435f134f010ad6fb2755315f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f6086aa6560e2d209c1288dabc8d639
SHA11e720f36ed5fceb0a95dd1a0d72510846528b501
SHA2566e9e324e919dc01b4714770b687eb18a409e382b52fa9d4e2cfaec63797b2397
SHA512a72b6b76705a312c763458f7dc2d54b908f473355d0b92fdc74d1a9ae3d4beb0cf4750439dbff73ecd6371ca69320512c691b9b51186ed67b159f3093f2de9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f65993ca4705f42f5cddeaa1c56fee2
SHA1268463a86a710086ca75be0c2842478434723559
SHA256443182ca672a8ed6c42646806a19e050bba4e25cb3cf0f721c6bd4f8759f0e94
SHA51276b5196c5904b54e5e7a9ab23e04b842bd675593d6688edcea02ec475e9f6ff0514f388a692083336695c4413fa1dfd5258e9afed68e4c1fc61461ec3d24a67f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598160b53b14dfe4fb44d2ddd1920b711
SHA13a709c7db5eddff5a74789eb589fb8f97e2c76b4
SHA256c1caf02337998415590ae16d09502bc96e49a2a30841e0fb75a9d139154bdfe9
SHA51282b9c0b82145f4dea961c5acb99ed330b5e2b4d69b1297e9ba5afacddd34ab7ea2f1c466f7059e84f7f492e22abb330afcb947841b2d0d263b6826cf65c721ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a40f62abee68b2629d15af0618212e2
SHA103236537447e5e9cc5a2cda12a9fb20efab490ac
SHA256b4d4ec217aeff3715b4f66d44a932cb8f4c256d145854654aad68ad05f6aeedd
SHA512f8e342ea794aef30e3692d51b87590ca3c10b57708da3c1de79ab066b8882163b2a699568cd59caebf5cd2048b8adebd5d9a903b5b94bd4e2e87bd97b43265de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bae8a95abc456ec0e4bde88f29bed85
SHA143d96ea593b0192043a20ea80cd0c9e43d1f50c1
SHA25652ce9dfd7b9d8e9f6f67fc88a21abd463c2f6eb736ad0500b616f1fea86e3fef
SHA51250fb56b86269c5d935db45824992dd72573f262342926d654724f05bbad817e9f05631d233a0b3b323ebfe8a0e6e08c292aa9cba691a0e42ff2c6864e59ca3e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5d461f4b2ac7f82cac475c54aa4894e
SHA1ab8f9ff04640b70b6418aa2233c991d13c5c8aa2
SHA2568eb6cf17f7c4030f84a121da3e850b7dfd5fa4010d250912b5522fe4e4be57d5
SHA51273d6d148b6c8835f1cd36320603493f0467c749e37902158f0b48f59a8947a9ad58929b114eb717f0909aa9f8c427dec990ba7341395d0820bc58955ed122f37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ce723bb92b0b632eaf469a2f56e78a9
SHA1d84b32d9b8ef4e95db32f0d114a2f31b00ab1c4b
SHA25690e37144f3caa9f5ae04f9a2992518d902260a4181782476767ff1ff020bdf70
SHA51233d90ed525d43179620f0cc172996caf26d4a9ee0813b60bb62d9214542127c9783f89fee938a965663e369a7bf7af3170dbae1c4d87225df1122d2a88a60729
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
136KB
MD561b7682e703377c60d2522d8472ec424
SHA1205fa2191042f4986eb7d2d930d81070f4777a05
SHA2568068db10134871dd7f3fc5fff4638410a902bad7822622eeb933dd7e70dc80b7
SHA51216ad4bfa04927d716b9f64938966c803da8599694c2b0304d34cf57fea4eec03004ca60929930879879f012a73ffed89f7c7f181bb2ce9ed0db3988af00b4ec4