Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 02:47
Static task
static1
Behavioral task
behavioral1
Sample
738847ca38df86d832ef1e3d8c51959d.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
738847ca38df86d832ef1e3d8c51959d.html
Resource
win10v2004-20231222-en
General
-
Target
738847ca38df86d832ef1e3d8c51959d.html
-
Size
6KB
-
MD5
738847ca38df86d832ef1e3d8c51959d
-
SHA1
c0f8fa5c1f5f2e4e7baac20dad58ee12addf7484
-
SHA256
dcab637ec9b0bf4e65cba53d7e62f7a09a654d2e0b874ffb9ba15dac7b4cf33e
-
SHA512
8a9c128237e8eaa5a8f4cddec8a563fee17c832e5ad83a5446382e5de26455a7cc047f1b66adaeddbfbe9541c437bd068d59c11a0c1c42f661b879a195b13a8a
-
SSDEEP
96:uzVs+ux7lvLLY1k9o84d12ef7CSTUcPh3cEZ7ru7f:csz7lvAYS/r3b76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c200e0384fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000000ba13471386bf1cb27b52dd1163a4a5e614535a26d8ceadb9184bd3ed117da54000000000e80000000020000200000003f5230fedd111ca0f1347933b7485baa335dce97b57b404ec1718fceda5a093b90000000cb6878df3210dba27f6f30a803e0d18007403d56f44ff2e92be09c06b60b89c75537aa25204654896e72fea7af6133ba04a84b03a7b31f8c3d3d7c491b9cd8ee7ce9f07f9a0446642902b746d2ebc7bf45458bf60a0eee453acd85500653d327232a7ad8aec4eeaa8fcb78764993090d1d641e6f273aa30076fded404b7b46e25159526e7b90254357242d3b26a2b7a840000000eb8924a33a90f49c9bdf5b41d70e53bef9d13165cf84da74a970238077e4b6c61b949c54a30323459d82a15eb9610e1a95b2a7b2d8ef31f4580e1c8c4b72dac6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B03B6E1-BB2C-11EE-A80E-FA7D6BB1EAA3} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000004e3c234184a9af53edc86a9935686ec54b14a0bf8983f22a7172a5df19858458000000000e80000000020000200000001943267ad1a6fc83b538f13420846b0410a0887dfae47660e989ec769b2831022000000020cf16ec71efb899d08aa728bc3d7f91c36a47b1c87cdb7091e105ec94cea7e340000000b2482a8db596422f283d0fc07a66a1acca8be0c012b00043a644c4e320f461469683b0df21f4a182566876ac8473e92b73553dd16eca51aec45ee33c4ab8d194 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412312700" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2148 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2148 iexplore.exe 2148 iexplore.exe 2668 IEXPLORE.EXE 2668 IEXPLORE.EXE 2668 IEXPLORE.EXE 2668 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2668 2148 iexplore.exe 28 PID 2148 wrote to memory of 2668 2148 iexplore.exe 28 PID 2148 wrote to memory of 2668 2148 iexplore.exe 28 PID 2148 wrote to memory of 2668 2148 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\738847ca38df86d832ef1e3d8c51959d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2668
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3687a8bbb1a3d562eaea4490b7cf74a
SHA10240056cb6c1d7ec44b0e73b5cb70d81e713d495
SHA2564cf1a482aff89192d008b404e765609a6d38e099e9756d5359b5742aea16e3f3
SHA5121f3f7e75a9601f756658f1301c765add3073f0c3ff2a91c26a51712e693068e9e0b6bd98c65c0d201fc9458f6e1c55b7e52a64b419be184ca6e48ae20b23f7b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5970fb6f5c5d88a143c9117d01880a4bc
SHA18f5fef9efee472b75f0e71a4555efe99d5354aa9
SHA2567ffc030387454d2f3bec2c20b68c51a39d7a59ec9103f9130159ded256df88b1
SHA512fe1da8b878ba9a69b6f5fe783440fa29bd1e146c154f3b879511dfdd958d8b489987954c9297b8171932bf3284640b30204fe1e18a961140102c1c74d79f1b5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3ab5b7e5f645259d8392604d73e8c54
SHA15bd10a2380be6bdd3c9081a86ae4189729c52894
SHA256b13af604e04594c9e210b2da85291b9c09438b3325cd8990ff44cf1904ce3caf
SHA512e32ce25241fd79e6f026ce017048e1c8cf7f85042801e16cb546dbfd1b1e31aa6ed6646f774cb188362869b0702afb7f26c041f7cd879f8fed4aa2538fcc6bbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afc4bee7a7bf6a2234a0dc91bb126fa2
SHA1ad8336a713761051a61dbd9bb5466eb2d214d121
SHA256cb03a120c1e047a524b346e0d69e6f91de64cfcc81616d3cecd6e02cfc1e84fd
SHA512c0328e8db592b4706940572f39478476c8d2b09b82c6f648edfb94023dccf82369da3bb7a97bf52b9b1dddc37433b3a38195c48a092c13106dbd3674477e2b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b6d8ed919ce5b3912add681a7ca811b
SHA18135ec363251bcdcb1d2fa31cbf1e63035a0d36d
SHA25649169e9d11a10386d0357a742717ceb96190967cc87ac36ae5328240b3a7883f
SHA512b1ecb335d4291d424013dc31ffc2e111ebcac2830ac77a9764f1bcccb197f8f2e873051d3837b6b32c7dc0130372633ac0a81c1b916f5d3d1d4be2186da27322
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e0a0e7f35b50ab49605b711a77d4b2e
SHA1f951852db2e23cec0583f2efce6ddd9b32d2d945
SHA2565156a5d1df426e585969e88c246383725ed125feb09fb2e66f3da541b1e1bb33
SHA5128f5617514b475ec9187e3b7b1939d12655d899269b0e71df8b7ebbbef480d1359cbfa4f56cfc32551457730b0410b6628c6a2a963729d9b72a732835e7feafc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ccb36a769e7dcc1b47e44bdc62be547
SHA1b24e2eac337ab79f5664bc6c4532ef49c60b8317
SHA2560e16bff6ca4a05da71e504d5a3a67ec67f769747d6317d556a67c0388ef900e2
SHA51296c64367d434e5837fc75f0068047eb0705c9cd245bb82fc4d4350a98bf8f055e43f4cdf24c121837c6971238e832cc3e8cec7099fd51a9c180e09f2d2394e96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5654fe717c7f0dbb1423f80a87885543b
SHA100ecb472b26f5c8c3b6f99c1c09cb9bd22f97304
SHA2567fefe0c81629e8b8f9f2168ae0a14a88ec285681b326e8f28fca451e7117cdf6
SHA5123244d6b24db60c300657d94fbe7af98511de6b281c2b4f47e9f023cc494bcb306b187b99bb02e9cb7da9665e54845f66f62180cecee6cb7a079811f52e3afce5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e86e9ef1f9acdc70fce2ab05b591c276
SHA1ca24a53415a1e482cba3b685ee052d17452faa33
SHA2567c2a5b94e71108e59916d528c5b2c79b9e5cc094fac1a0088c0604af25bd5b32
SHA512134861e000d73980de6d10f255299581d87d17a0972364f0009914e25339af7e32e17557a443b3a0b01f30013d84b9538a64fa9bb90ce69640e49c8bbdcd3359
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a3dd3fb07949fb64abcd01ad139f35b
SHA129bf3ba0d2e3f8c36797fbbb13a3b43a4f2a4a9e
SHA256c45a81c151b47412ec36786f17952e1e7a1dde4af8382dbea454d6ee999a9f3c
SHA512552f72aa1ef044f5ee9c48cab3872cd01e1ea46f314764dc5d493a3e341a9fcb6fc8a3c5c9e3cdb6735916b9a18016d80b94afe79dcded3acb8be16264439e3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c43c4935c91c19ae5ca1d803fb072d27
SHA1f2d1ddf9e47fd7a5d0947f9a4706d4d9807dbffb
SHA2564a5f9fb7f403485047830491e198aae8b58ae26ec654147e638a76c549b8d7de
SHA512dd5e776fd67b85e786b90f7f4754fa88996769f85319024484d4cac083771fe806013b9fc7d268587e1c5de98392ec1a72c9cee6100f38eee3341afc5c2c690b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec35015855e63b30dbb98ae47f6d77db
SHA13aefa16bc6d9d8dc89f3d34bd0612967a8a611df
SHA25616fd9d4a3dbc19de04895e76f77035e460c041f45bc79fa1db7fb6740d0bbc7b
SHA51285ee9600e680e089c7a1cb6994805a5da52f039fa01a61fa0bc97a0bf3ba7ef6a90bf2178391ba852ecb3cef5768f52c3e7d86f91488722952120b79afb08eb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e703e7db7f9f5ea76bb9810b58de14e
SHA1ecf723d170f5ace2f7813de0f683c417f745de8b
SHA2565e172e0622f055708c78b886b595ea0eb6900b3b80272c55758af763d402e461
SHA5121d813d3eb6c1eadc977c855417a877992c0051e3d9d2d42e953dbcc7ff98c6507db0a6c9b93a24062173620c9f775fdf84343c3ac7820573bc5966715cc784f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7b54b2ad2cbc200b8f1ab0bbb9fc7f6
SHA1cf642f2e9f09d5811712efd6666a533dc0be7ff7
SHA256f5bd3bee6d640cca25d5eaa2b1f8dc374f72775552d508f69f8a694a5637f0c2
SHA512833e4a448b35541e116e29ab37aa8db7b0a4bdc1f5c8f4cc6f092aee32fa8607920e37e790fcbc77590a860aea1850d1f9e28dd42e0fd0777c8d44d16685c6b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57059f8faf9dd76be931396df0cb6d2cc
SHA1e9175844e0bada25e93723d43fae6a8cfa87e5a9
SHA2567c66ad0a00a45a169a11907bfccfc84054b6a4f2d24d5b761e32ebd754160470
SHA512f21118c3852be18da87c37ca457e3759e9357e6665d98ca7c4db4f1684b8dcbc6bbb5a24c450dfa183c86b9a312ed67394d55c6e2cd685262b8ef7de732071ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5749c40c7474e0fb98e9ea406e0dbf661
SHA1711d865affb6e1d4bbdd7ec82495136089f62a15
SHA256f224a1609df12fd1a36d8673063b7d2d64947fab63e9c56142a06b990cf14374
SHA512baa37d17c83abb12f005bd17995d406ab9fd3cdee9b875040f798581f2e60b4462ee3e566288b79cf36958f8a81508f5eeec00bfe3ffa944014b5a8faf863fa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556a55512ca43718347ef2de70748ce68
SHA12e3e55ba77db7fb4b79a6e360747d476572ae8c7
SHA256cab5bf27ecefbf79d294f33eef1680436cb9392cb44b51e311e50f6d507d9537
SHA5123d9c9b1dbf95d1fa7876bef519e2d1477c6c28158d53a929138c4d23c94366df92e3972be11b9b9a8ae174fb5b7c624ec572196d59c8d4aa7b83eede889cd4d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b221e0212f9ac02ee3e9eb89bfbb22a3
SHA146d4732036d145e5d6f1e50d0da78bf129ecdcb7
SHA256f3b6b82c4e6e5416b9a17ec2fb707171dd0997b2d07ad076768b95de095df9b0
SHA5129963acb46509beb7e4d2889fbbd8def19ce6ca03d2a68d43d1f2ee8a00f4a275fc916e51d4dfaac77a2504e71065cd58f171f2c3c216068826353f9f9337c61a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06