Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 01:33
Static task
static1
Behavioral task
behavioral1
Sample
7362db13ea8e6ad4ea53412a443c495b.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7362db13ea8e6ad4ea53412a443c495b.html
Resource
win10v2004-20231215-en
General
-
Target
7362db13ea8e6ad4ea53412a443c495b.html
-
Size
8KB
-
MD5
7362db13ea8e6ad4ea53412a443c495b
-
SHA1
be674085837812f78f4c7bb200a365bc3c644011
-
SHA256
1731238b66a910288e9586d2fa287438507c262e4e54bdd4e543a4f534885029
-
SHA512
7cf8fc44c45d860077b0391b9275728f58852d9918946c2447ffec62fcd565e39cfef0289a794c94b799041869b6b29af87c860531cc420930b24760e41c0f22
-
SSDEEP
192:FB16+I2tdF3axv5k6VKHmTUaEGCJegWh9rwZOROKJVtvyjEEEaQV7/6tDfZcMP6:Fu+DtjMTUajL3EE31d
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412308308" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000909fb54f25a948f1390b6fb92f874e349d47f9b14efeec66a4bcbd22f052bbc1000000000e8000000002000020000000bf16ec89115fdca9d1fa2e3cfa7cfd481375cc3950dbacad47cf75480c3e615e200000009ec88e7fe579e0cf109baf540c016d5fe59d8302e26b7dcc59dc56c7669e3f1840000000882699a90cdc4e9ad8bc30560d20951b3f458ecf2913cc55c8b955ed9b01206afe42a5207cc51b9574af921a79c98d721ca7cc2ed38340e29eff365413a595c6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9097baa52e4fda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000050849384779866dd0ab6b59692fb4057c60f4eda576ce74b833a91a08bf6ae72000000000e800000000200002000000096cbd18b3f3ed36a00f2c3eead16a822320ea0dfd01e27c175ae3a89b4bb086290000000e2a26a83d3d497787d9b856097fab5b93f3cbeaec6ae51763ee1970fa11267d6995e4616815d8c4bb8dd1f93a1be612d60cc41ac9a2a48d472175f5825bf0f2c88f36f06bba421450bc2db80d83430bc0664193f8f44e87fb2f2837e68139b91ae99ae3a35f6d4d9bd60b9e62e072c9118416ac1903e7a946438fdce6a06c1536ac30af84af80b60ea91113b68e7399340000000c8ad80ec61d10b02bdf7f6a40e2b768cf461d0b770723434c315becb91c0e855fc1fe2336b0e618a24bda19e978f004af08211f40e2c9fec088fc0fcd2b55bc2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D12B6121-BB21-11EE-8DA8-6E3D54FB2439} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2532 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2532 iexplore.exe 2532 iexplore.exe 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2532 wrote to memory of 1404 2532 iexplore.exe 28 PID 2532 wrote to memory of 1404 2532 iexplore.exe 28 PID 2532 wrote to memory of 1404 2532 iexplore.exe 28 PID 2532 wrote to memory of 1404 2532 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7362db13ea8e6ad4ea53412a443c495b.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5344072d9623ea59f352742e41e5b553a
SHA18ef25099ca07cf0962c36120b82708dd1ee806d3
SHA2561bb285f12f847b2c091369710f713a455f1a459f04bcc05a3e4e814969c77001
SHA512429f04613a3301d9368d9bc96102f52659994be205e61d9659631e072837ed56c0b979ef8af5e0299b94d7c1d89a28ced2873c3d7f800ca498cbf5d3f8a9d49a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9072169c6d4344c37247cb55e43ac59
SHA1b4c1e26fa199714d50f2426b6634bef66470d3ce
SHA256977e23a29443fcd5dd67bf9e86ef07da1577c5719b8bd24c7b324e135b2b4ceb
SHA51245d57f4fe49183c12cefee8050c39aa0b23a08db4a6f04c3eeef9c23cb9a291c18f3fb283184097879d22ecf6c3fdde72a28279f5da0e3a2fba8b735cc2757ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f79559b50d850a4dedf2335f677922d
SHA182f65130461284fc428843d3cfc22412f051ece3
SHA256482236c228ce5a91f277c91d02a9dcc6f4507b23f17275f975aab8083729b5e9
SHA51254319902aed4bba2810b578b0b2c33fb6d3494d0a84857c11e7a0d3dd5192cee86b6cffc0d921aebb673c2694b2f17f4cea0eef97f726b034b6c976eccb7beb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ed6ae98f66bb4681cf181145affdaa9
SHA1c95d605c70c343da6d90629fd9ea1e1b16fabda6
SHA256ebdd099399fdeb212f9697139c8336bd3b68408bf72876a9ae17e6f6c7e46036
SHA51234bd332f1d4679d0f3efd12d6db0fd46ba6e20d565c5819a5b25c20c0aaead4fc66b037e442ab2df0f590514beb212922fc91d453fc4a66c60f97d727a6c893a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5940a4f62e97998c57601f0028ecc5576
SHA125f3b89af7fef1db3d9977020569aae82ce57fb8
SHA256e88ceddd2b499af36df985b87edaa4c91b5ada614f5a35bfa14362a119fd4a2a
SHA512aa97f7d7612e5ea07b5c2de5e41046fba28d44ab8a433b2d66602a7995fe46bee7c0f7f02d91f44f95fb799058cc8d7898b2fb55ebb7bc872472c0b0ba18c77a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558616beeeaf0c0a9605fe5107bc674ae
SHA10ea4d410e21b5a51383ef3f2a6d70ab42f24acc4
SHA256ffb3b31c6868717c3962d4d8cb642971345a1ae7e424ccdc5b956179910c3f8b
SHA512b9179227adbcb55b4e8916f078e92d8cbee78269ff6d472fc7bb26dde086dce4dbcc78aa6a5410ae4f2db892360ed109ecdffb6dfa36440b46594e211b3f8b5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5461cd413b62465b6b8e998b9f4a20c2e
SHA155fa9ea3595de896d932f51bb8c43d74b84e0a10
SHA256f45b378f7e9d02d21bfbf5f034493f0c1565692b35edd281dee701f91a5c8064
SHA512353c162797255d3433f2e71217df1a6283fcb6ab99d10e8fc628297afc6d0ce6808a5dbbd333755e11ef03ef45b104ae6912f7d92bf842bc73326d35588be152
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5bcdbda5ecc2791b2ad579260a98287
SHA17bcf445b1a98f838072ab679aeb466f9cdc9babb
SHA256fd725c5499db590c029d36babac7b1d1b2afdace40e40bd20395cb6fdce79fa8
SHA512e6c02453b4af197dec3d1b5f52b0e038685af40d92a874a1fd151138b2ee47891bf8b9a5cbd4ff28ce495e302d3c805130e4ec1502dfae0f4f69908394014de4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d76eac5c93594b20580268b0bf78f33e
SHA1e9e0903ea39f10018eef791315905a6c9c3f1f46
SHA2561eada9ead5819aff0117f97092b6ae32cc91f7031a7f347011be82e294bc0696
SHA512e577fb609504b61d1a80e613f0b5b2b4f5c5b6b6794ab5183f042fbdb8c0cb1213956aa36339deab4f767a2b595443551392e34c92f1484f83cffe5276d534b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547aac968f7355713f351fc583728787c
SHA1f311e2ed0ee928b81fa9d3211b4f5ad5065a5026
SHA2566de7ec30705b77817e19a0cadd5d66e214c108d437e0bdf3ccb6f8ead31e081e
SHA512664e2b8f9192a051a50b51fcc0ccc77d5e28479c6a210008f084d3b769750dba89ee0d6642796e810e8fdae1e716dd6c40791105202fab54091f99948946476c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a2e95e1b3d18f7dc3554e03d5332020
SHA10d48e8b59f923cc105b56fe3bfab8b8209e5b630
SHA256f2af2835e4cb679ea91ff0062f107bd8656ede8a66fb5ec7203f76b37cdcfa26
SHA5127b6823d784af3af4ad609ee90588eefab3bd95bab90bb0edd6bde513efd1dbd710454a94d12cc3b3cb9f7d49374f8f29fcea3677ae2586e0c27542aa80b1299a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ab5f4199521b165afb2d48777e84f39
SHA1e90628fd56809af99e56a5b17bf89a3b6d31602e
SHA256a204e13deb3e99bed724875ef0fa34150e34224ff726b0164bc9baef0c569203
SHA51266a5a5308661b8f33bc17233fcdcf4f627da2bf35fc88acae9f51c12ac8744fafc185a0ae983881f9b822a5416ddcb017fbb1a39c9c87b47eaf08bb5317cbb2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ad0e279cecfabf5177359351198a862
SHA1f15cbfa166dbd4f306d33496d7ed3bb7888a4d39
SHA25694a128296ba9f2eca989ae7c0784da0d7e992b620e06c4adcca7cfb27bedb516
SHA512a042acbcda42a36aab922b6e3594b1c9c7f9bededc8ce4330973ff82a4c3a0743617f3b099297c9be0b0c5d1e194e458285eb7d4ecae519f98ecf6108d7e2008
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7d181b51fe114dba1511fadc5dba022
SHA153541bb1535b1795bfc7b33fce48fbf74325ada2
SHA2560a51f4af535f0b090ac9ef19e93eb1487fa4103b23e5c0b2f8b2210a4825583d
SHA512935b079664efb94bdab300f000946931d9abe6f51ff160fa893ed8f5280b579424578a6cf981d88701f67a81e845c1c4f95f01a53968ac2ac2dbfee12f599347
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566f8fccb7e725e9517badf7c07845e0b
SHA1bb0cbc83a7b61abac5038b37a2370e43c944610b
SHA2566b77237efcdd319be084dd0e537d780483f772eede3996cb8b5c7342b478f3ab
SHA51261e94324a934a93529507015c0b35e29449dbb36c82149269a555adcf23a9347593fa61da41935e615068e98e5ac8309c7fbd36bc6bd7ad1bb6f2cffff767846
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573110a5aee5a99be6c86f18d43241761
SHA15682f76c11e83448497d1423c521bb4b366e5ac5
SHA25671b8eba5771a05db14b5ea6b88eeca9faa984a8fc8537b66bfba6bc3c7ec2ce0
SHA512f677c49e6aef8b33ef6b03ce7f51dbd084ec335ae5b5dd776499d0ce9180751e23dcc11c4d0b60bbc9422b1ebdc490a0977a95bc9dbfbd49cae48d87f146e06a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595e1b50dba9b029c1a571e0ca52d1f72
SHA112d0cbc4160df1df4bcab6fe80e6fb890fbed5d5
SHA25624cd974f0e4986618b4818a400cf194fd918530fc87b3da43c7e587804d60ed6
SHA512efb4860226a85fa09d8a8c5ceabfb8ba85bd1ab10e3d7829f8a4db0b74816871d9a80f552a65697530f250243b34c2b4e41d68ee78bfd11c5bf8988087ad8bea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a508a747a952970ddb281b1e5b304de7
SHA13634212a0e6080f22921adb9829822878dd5ef2e
SHA256572d7bda141fa2ec97071228f3b96951889cca52c8c62a63d1b12c0b477cbb2e
SHA512472258fb7703de54ddb8bfc35418c96e15ee3c7995b809096b952107603279caba3e45705651059e18bb2f447cd632d1c6e4d85f7d1279eac4de5a62e8f655bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591348ee2b3595b7af224c470a5643ad2
SHA16c4abe88a772c49212a1574e31fe5f3f35bc22d5
SHA256222c4a87f5af0cd8a855e26e3db02140d2b5761c68362c89c9ab805910d79405
SHA512ae00bf11be73384322cbbf863cfdc34e8eb0fc3c967af04a771982083797ff76f14caaf9b1fc3933fba8ab9a9d1ed8ac40353755c2b26a91e8196349b0c59ad3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06