Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 09:17
Static task
static1
Behavioral task
behavioral1
Sample
744faa15b054161076c7d5f378862694.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
744faa15b054161076c7d5f378862694.html
Resource
win10v2004-20231215-en
General
-
Target
744faa15b054161076c7d5f378862694.html
-
Size
53KB
-
MD5
744faa15b054161076c7d5f378862694
-
SHA1
e3c8e110117095ebe6ac2a19202a7b56c684d18d
-
SHA256
e84f5562d1a54c4b7ffbf59f16b30f849a8f7dc5305bbf0772deca38292ed42e
-
SHA512
20a0372d4d9b0f7906a5cae785ee1e04ca1728a1c38fd818354da9ab1448eb267a1269e1151cfa60ba4d85ea9b3badd05e2e8cd5133ff63bd0cf308d28bf36d2
-
SSDEEP
1536:9kgUiIakTqGivi+PyUKrunlYI63Nj+q5VyvR0w2AzTICbbvoV/t9M/dNwIUTDmDB:9kgUiIakTqGivi+PyUKrunlYI63Nj+qk
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C797031-BB62-11EE-8A35-62DD1C0ECF51} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000b2a483fcacb43f9c250aeed15e026835b80da97ee12adb1d55f1774ba6413ec1000000000e8000000002000020000000f21f8e65f0955dd596cde471e9cb6452e9d5c657b4e542d58c1a2767f23d9df620000000fe0f30e6afaef8578a9bf8b335982150d55cf74d9dea23466cec7d1c7aedf5be400000003b6b6941b74c252dbd68a3cdff84295c4494d3cdf1529296429057cac2289c7f7293f604c7092f32dd6a9101d7291a6d6a07faa83dbd607819af2394a03d562c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 203c33626f4fda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000b27d7823a96de85312c457687f98bc31fe510c06f7b3b708ac54c0d1bfba0d1a000000000e8000000002000020000000338618baf524c73cc32343ff894d1a1bf472d543756bc11b461cb2a8da74572990000000aa670f7aeafc2b640db21c8b1ed90f6daae6e82238e08950a62010f623d0b595842f2a9c35aed9a2ecfa52a942f22f8d73d0572a43693fae80eb320503162611262fe31eeac8587c8fc880605e573c801b1ab7bf1db9fa55861c027fb489f1a311b4fe07eb8ecca4c8885922f5de8c90600d27391942e984c6355c48e849191a4cd1c1b1f9b4c441841473fd3b6a71a14000000026d6ef2a09ace0f059232b0232f8a5b98794dfe09a4c311456fbcb9dcf5c77d6fdfffd0aa01bce499565d086279594851b80929483c83d15f2ea4c5a0826b142 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412336110" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2364 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2364 iexplore.exe 2364 iexplore.exe 1828 IEXPLORE.EXE 1828 IEXPLORE.EXE 1828 IEXPLORE.EXE 1828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 1828 2364 iexplore.exe 28 PID 2364 wrote to memory of 1828 2364 iexplore.exe 28 PID 2364 wrote to memory of 1828 2364 iexplore.exe 28 PID 2364 wrote to memory of 1828 2364 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\744faa15b054161076c7d5f378862694.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5592bc8e5117cd9dbd62c2c11ae0ea974
SHA195e1a082cf3efd0f2b70fa5ae6b58b4ce65aa67e
SHA256903548de1fb1607af278f5593a796a7227c0185adee51aec3397788dcd176378
SHA5120f50c11745d4417af901be8ea0862d02430d1080b4477540edba8cc82d759fe566467b3a8f2262bae95160f29873510dea74c7eb6d2bba41b701796ded0340fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a3d8fb1694ed28e286f5e8e87518410
SHA1eb7118aa7ac8a89ce2e23db7b8c65513e43057b2
SHA256b576718b614ce7824b868c2f116a0c2281921ed7b5f22c1e889c62f3254e70fb
SHA5123a0b639663e174015c2ac523c865627744d7b580a4a90a86bb586a1433a455af6cf33347555f2ea09a23188e04ba7ad06f47c613119e4651875b156c917ce35c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fddca230aafaca33a70c31d1552a4d9
SHA17fc24bc72e60f90754d47a0070c18ff4481f700d
SHA2566694837ac76f7146df1818413a019f2293a5c6b0ac570bdcc38de9ee6ae89843
SHA512fb422cdad6436ac9710129799d71de8c5c07d43098915ada93ac580edac43512774c178f1597a8a4564d5449f0f375b1e40688846105143f7ede3fecae789d08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57dd60806b4687ec11647cd28b39f1686
SHA1091b1a12e619cfddd25450ef4b98e1ef2d82815b
SHA2560e8c5faefd1a1fb0060607d1035865f5b3df1cad66c5f73075002d750e82756e
SHA512ffc97473788eedb497a04fa3f16713a854cc9000e356df5cbedc276525b03eee8d81bce1e8b6f6ed11dc50c41c90aad5b987bd92eda5e25d0db90304c08a65b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55eca313f265b2a7f792ddec77b6eb87e
SHA1bc8ad15aa77d43b8b873007fadf7087d333b97a4
SHA256db6a91d1d9b628a05f949e9def35f18289b3ede27d4a19c7ca18896805d1f62a
SHA512084d8fc16085426ee640a5677ce222a3cbc18eb6e815c2265fb575214e5b1b07ca8a24a118843b918d4715c01fe23f788e687395f1a493bf888d725fde364fef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efeb908a772dcffdd2a68bdac9a9a2ef
SHA16371fb57db42236175e78aaa34619840b1b1d185
SHA2568c8d0afce1e1647943bbd452da721486f921cff340225fd17ccf3bcd8c29cdaa
SHA51253116bc79a2a7d7d591f113b563a5c72617511e2bee4083b9f558fd7991baee679d1ba2fcb6cce36c57ece361f0f28436669053ab40d05faf5654d25f988a245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56389fe316435a080e6edbe0a7386fc3d
SHA1022e77087f8e751280ed4033f770998975a642fb
SHA256061ed43fd094cb0fa7c920dd87c5f5970573903e5dde0e95c10da7eb5f3c4b68
SHA5120bae8f5b4ca4b599c58a271a8ae4ca630bf1a01d01a70e44e57f35eddfa6e839a364e2af2fbcde3fe5c9b9fa5d18b5764c2506c3cebf485d6e6c7bec4415a3ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7a9d9543c13605e7fb31fbab6a24745
SHA1ee960ef605da232285dba5edfb43ee2301093908
SHA256535d7ef8dfc1b2fe7a73c93f49a79d78597d487575252c8d5b8df6bbacc74dd4
SHA512fb5875391874ef102179c6793f28b73e05dc312fe57944d9ce47a93e5fef6728c5d7ec7bc2b3a8057b1589626e53fbe8d61e3e85376a53640e33428596597ee4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57361e39d98a644757da7852db6a414a2
SHA117b16098cd3e1b6136f834bfacff21173dde6df5
SHA256dd1017647507b1a32d0246329e7cd6d06ec44b2749028beef8fe3d336505909c
SHA512791698aaa99c2c951306d6500be2e6d202f8d3d3b0998748697d63eb993ee86ad234107411d781cd38d707a17d859553cce1e898a81c86b59d5f427355a32a49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bad24bb4aa320960af8a2b7d3349a59
SHA180a5ed7a55f18d0607952113abcab26674f6da03
SHA2568d29450963fe22bbbdec2e2cca0b06379b833e7ad1838f1fd5ed3e6afe92f3d8
SHA512c2f5b30d142bb5fc64e3884c19fd7d461d37f5bb949c969e88814bdd9959e37e6f6497b4e064adcdb495b34a3970ce19056f7906adae492edfc9347acf7a3f00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bd4bd8044cac905d7c8238e6c684fa2
SHA118a6271730c742b19bab09703ae7d681ce6e9950
SHA256824721d5eaf8c636cd50f340c22cbda5a53e1c99bfe836ed90e95b333af7634d
SHA512cefdda0982a7393cc26d4512dff7310fd4a4442bf6ae55fb905128cef7175b2cc0864cbe4e8702767b973529304d1ec4f903a8d37630a13b9838321241f67481
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5116fb4d9829b9410c2402183e7b30feb
SHA13490c913fbffe1bea3ca724ba23c7bbd6c10a0cf
SHA25654255ba2fdf0dfac3d7bf2abba701a1327fb10ec51e164d36c9b12939b3cea0e
SHA5120341111c7dadea5bae7e77dd346326ef75eee0403e3ac1e3611a82c764059cbfec770623a0a6976a5f38ae795d386e3c5ca87721ec0fa7d36128d6b59cb71406
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6eb12057c8987806ce006c72faba32a
SHA1f88eba78207f583eaf57af136803cb87a497a1fc
SHA256c7e32c5d61dc49f0e155913f2e47520973f95aeb440a41bf885f895153eaa66d
SHA512359f1e11505a0782c7126c587c719c12b3d3463dbc95fb7c1a7a2ff02cd2d024b6d090dc2e1e71bcdb8e38ea66200200ce245a76be3eaea97ec7702f34f2a886
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59510a0ad117fc706644b18f0e5324436
SHA1efd94d56a7354e9dff36e86263e3b2fa3d2cc8e0
SHA2566574e4f372c66bb996238829921bc48a976842a5160bab429ad1f28ba8df0bbe
SHA5124075dbd318b83ee1917e9dd40513d22cfdb478c07faa5a6cc8870f14d0280866e044bf72ce7d061865d3e991461b89e94ae362ec069628837f6894338a320720
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584a153f2923a6594c6088901bc5562fc
SHA1791bef046d3c12078fc5b400005771e7cc6e1658
SHA256dbd6f2a43f5090d7d69e75e8e49e3c4f57e852fc88b203b198c8440af579b2d7
SHA512e263c21049ee3cf9562c8cddac46c5cd8947106895584580ffd1039af7e32edf709a14771cd317709a57d67fd047a5bb3ba7e0e825af1971375648607816b2f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aef52d1cb0ea1f832f4c9b89097fe579
SHA136390aaaf911c7b77c713d33bf8ae85feffd499e
SHA2563ebb6fc8e1f15c22abaab8df762e726b179b10d4a1ec76b3f5c4e6cd5a2c9e5b
SHA512e07d56f3022204f1d4cfb8846d8c1efa446530e1d7796e1980495b84f48f383125b45cdd2d7b51f7a028971ef4032b5daedc384e18c0957b7e7551e7af044c93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c50fa2f499a79f04bfd4a1c5b1012e84
SHA1e87c2574b59b75be6c7232a998fc6487ba18eaed
SHA256d27069a30e62c976daa4697b7c7340ca6d13d1c6cedc5f8cde71412266f660a2
SHA5120f6c2db3c60f781ad0345a3dab0787c0540b63ba3aae6673ba160db7319285c2e8be2e8a6bd6e2ed40cbcd26b89ea74a8ce6533511837eca335a84182f377633
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501016fd2771b0ef7ab2c7d9dd95d228d
SHA194444b7fe9565897699682813f7e43ac03b9c6f0
SHA256334ebeb2fef3fff52cfe85b4e7ac560bd9be68b06bb79dcffd9e90f952b7720c
SHA512f7761dab90a5bb3b2d47987d237a69f27280254b8149914a36c0f39683fac2d86b903104ca31b17ee52c5adc498b580440bb3da19b977eb2c4082d4d8eaa09bb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\script[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06