Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:38
Static task
static1
Behavioral task
behavioral1
Sample
74fc8ac467983ba67e6cbfa027229224.html
Resource
win7-20231215-en
General
-
Target
74fc8ac467983ba67e6cbfa027229224.html
-
Size
23KB
-
MD5
74fc8ac467983ba67e6cbfa027229224
-
SHA1
3eb459a144038eb6c05a5f7c96c2f36753071be7
-
SHA256
a8b7505e626858befee0ea5cc9fe6f23a3a394d4e9a9c63c95660bf6f3381039
-
SHA512
c23c7363e6a26cdba44e8c639523e72ff562b174ece2e4f2cd3a723b218fb50e5385df85cac4df929f9158f0a79de89c9bad454fd813727c7c2b1471d5d3c28d
-
SSDEEP
192:uwbewXdFBKTthb5nQzIYJyoufIWDjgAEhnQjxn5Q/WlnQie6ENniAXmInQOkEntR:GQ/fW6F
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B412861-BBA0-11EE-8452-CE9B5D0C5DE4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ad2b00ad4fda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412362578" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000013a1638ad42bc81f760dedc9c0aaf0f817085adc6d415b46041d955ba5f9446f000000000e8000000002000020000000bc7078f32f9af30664802a69fa703559d506ad75ca4000575ac0495e687f303220000000568faf3568dfd5f10911bf1329f5752935e995305678b823cce95cf87ff452ef40000000162a828bb17651cf823deb9ebc6fbbd3c489603383a46481e04bd4a2398a2ffb5f0ad1a6930c45dfa9df86eeb395a03763a0b79b796cc583eb1fe331206953ec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000a92e9fd2dfe2211b48c6315a62371c3bc03b8b300a3ff963f28b406de484e196000000000e8000000002000020000000c234e605047c1c9569f450e9fc81bec3392ebc1cd54f4a9cd0da25d367b53634900000000e5265c50296f3601f74ee1ab6f556f6e0f3cd489bc8defd143fd94a09d1b1f62e5687215378a2c2f2edfa05b315a33a4e8a2b50871798b732b85ddfcceced87081d7c5a6b655d13b666e156cae1b7bda8f722362974bc56eb1c9d24892af5a0161f49cc49b2709ca552d7155bb7fea0dfefcbd04bc1c8842c7bde9c14dd59da326f1083f11e29f571aaef5eef634a684000000028b56f2bd8a930092a1ec0a2227ef32f5fb49af659932a609343e33cecac1f6f4f38d15c632255942a960fddad41022d0d5faa5d89c6e2dd235daf7f0cb5f6c6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1576 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1576 iexplore.exe 1576 iexplore.exe 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 1576 wrote to memory of 2688 1576 iexplore.exe IEXPLORE.EXE PID 1576 wrote to memory of 2688 1576 iexplore.exe IEXPLORE.EXE PID 1576 wrote to memory of 2688 1576 iexplore.exe IEXPLORE.EXE PID 1576 wrote to memory of 2688 1576 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74fc8ac467983ba67e6cbfa027229224.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1576 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5210f764686e5caf1bd4c57801a89d1cd
SHA1d20e1156b23962b824531bc17b4467829430faf8
SHA256984b630c51881bf52de3ec7f6897752b92b194b24da55234b989fd33547f05be
SHA512d6c7300a0fd6435fc3a622fe03332e8d7cf059f7235b8c1117133786f1f2b52d654f394fa56a57f1e53eeace39270338e4bfd2fb148a91688aecadf0564b8bc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9aaff16706d8fe9576298231b300b63
SHA14584aaabee75a6f84dbef9a653957a34e02a805c
SHA25640689659c7035863e5623d50d5ec53712aade0f8766f818df67fc27fb04d6953
SHA512dcc211017e469ec16bb0e4c1eba7e04fc692eaf0271713ab467f8396e3f2adbf3edf09bd9da462916220e0d7bf09fa780864f1cf278406e978a8daaa9d162376
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5827b8b089535eb2d84a79819b505a503
SHA1bf31e7417c20052d5e1fd88fba3dce83bcb05414
SHA2569b2688d03f596dd93c144af7418c1c38c43effe39ed7688adf2fa5593232f93a
SHA512a441e27b8916b827c667b7c3bc0262b29b905603ff969991d43e382a9922bd218f28db2275321984806774636e910e44e57219a1c757393817b359e4c60c21e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f8d9d3957d2343ef941e7b6b2a4ecb7
SHA10c4abd2461ed5b90b48a7314f2850fd7de874dd6
SHA2561d33dda197efe5fb0e72bf06a223c06fc5bf2091e679c351f71de35b0c454428
SHA512b61d7b316bd60565f20940d5c98baf9345b0e2a282db7a599cef39bfcb513419d733ec74aedf32074623dc3779066c6d2672919f095da50d2406ceac06ccb177
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511aff895cf6dcd0b1886f02da813b3b8
SHA17727539b8f6416b2ca1968fa4d12c607e556271e
SHA256df0e8f04af9e6cc9bc1f379c1ea014416ceec84e18f0a59d232963662a40a4c0
SHA51258a4851bf5924825d2e6157003a5741532ccbbf0d10f25077cd68cd3ee3857a0284dbff71fae44817c11dcf03c6d2a947e400f2fbd62d615b2299ab6439e3d27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518bdbf11fd217563f79ad8388eaf689a
SHA144f2ec85778be9897c898971d7b27986eb9f7078
SHA256d76123883266358a701cedfb98ad7ef51737aa2a7503ce68a6c47c3f99b52611
SHA51223bec7cca835e88de941f38f131ea8c24ba065f2105d84ce9df84cf2b020657f2a9971f5b5b812aeb3c0198a175e5bfe878d031e85d87899712635f1edb2a714
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a9cca3782f7122580d7c6a114e70c4f
SHA1d24c12375e313dca00edabd48f85daeac2b7ccb5
SHA2568554ec567a807325e1126ed9cb9a8fa1cde288896c562375b86f58a55bcb8dbf
SHA5123d3f877e1e661c3b5229d4bbfe4cd17fe748a4685b25e7aaa904e2b6a9698a9559687e0565970cbc4989fb89f035b864cb3b9ef58f21d04cb6db35122f1def05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6845797d39c92387886e982a4f03eba
SHA12074ba604e00cef2aea9e801f9a301c32fdc7d35
SHA2563ea305b88353a84ef094b4734d436e8f26c885c5413cd335388197c347da82ee
SHA512850b47e7e1e8bdf47f4016120db390537c48193e673c3cefe51fb39b45acafbc2cc30d5ba753d527ef563a23d686d185976d9796761df2ee408900d9813b5e9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccac070ad58f6946d350e562b1ac97d0
SHA1667be0f3ed02bee591b4dc81016346363ebbd311
SHA256c680bdf5601e630152abe03efaf12cc4070dee5a1d7f482001c3255fe01eb92e
SHA512a8a80215a78a4c931fad4a2515bafceffe182538863568b315a715487168f610b5225f719724ef42453eb0d821668d5c70211c819417f0ed0a3bbc0f93f673bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b072a5eafb6880d53bd4e4ed129ba8a
SHA115a9cbe0451459fff2209e4985a348c83b3a8ec4
SHA256347d9eae21f7eaf2968d4caf202e219621961ce85ea8e86f9527c92db0eeee71
SHA51233051f244a73b2f343b5c576e7b41cd3ec526c9eb8411f12c85b53aaf341682456b71a76465ba0dac86eb03d5b640abe12a3d8779285c21a8c5e118cd71aa20a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ab35df1e82c6ba0e74c76a933f0eca2
SHA10211f2fd821b4b9cbf5771a1665b6de1542e263d
SHA2566401cc90912982562efa5e8e46d1046931da9688d04478cb206732c0959e5833
SHA5126f579c7b39b883d79f8dbe2f71518c40f5a4b77baf086ecad2a2d4aeacf748913843a765bd37a427b2706d5430a9596b21e0aec90c3e102c8bc136a1d2bbcf97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bf58997ec64b6a611b6900215e20e65
SHA117afd3584dcd03ad13fa5b7e4b9d5bbda35d5a9e
SHA256a3d61e5625cf824477b976f547300417a0fc7432ee90ddd47eaef23fc4c0c3dc
SHA512ac967becdc7aa8506769fa70b885264bfe02d1e193dc1b5ec2ba6e1b94919b55476564d043d4a2d7e1e5624f7b42110cdbf4b686e3e92528b69f29f93e2531b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfb0f3926079b5d9657396e7d8d55959
SHA1e7136c734b6ed34fd3f7ef201942ed468d94becc
SHA2565ce49b1ed49cf56010c7e0142bfed27b8992363440a7d9edd4a2face3e5f5862
SHA512d51b821cbec4a2e05d90a6f919355e19f56f8c6e4908cd557ab45a32dbfadc52ee13b5a062394684b404b27ce52cd0d33c334c0636f9c5990f685f18f263ee89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586e30710b15d139eb8c3226483adf085
SHA1739cf0ee2fbb85262743e1e00c55cc9fcf4f049c
SHA25650c01baa13ae4d8980577c8483c12c7d4efb87be858f56ced19b5e683aec3358
SHA512a1562f44f29a4485a27ee2943972f32c1a3209b05ecbfbebc1a155db7b3c6a8583f26959923b0b87d666fb603a66d4f872b7eebc28020db34a18bfc3edac0d2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50155dc04999b622d72493ec87734bbe9
SHA108b152bd112daa29e0818a527a0ea17cb25f5fb0
SHA256bc744492739fce36755bd3d4c137c0fdd225eb3d78ab3fa8bb20515a437e99a8
SHA512fd181086371ad2a5e1bfbc2bf18cdba3637c240b2b37bfa8e59d6843b922e460dcdd72c430f291bd0db188d5b8fa5c7b412e49cb51322c7df277870fa4f5aef5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584b8d8a036d377632342473169b78126
SHA1b8176828b630057096b53e5e448e6976920be44d
SHA2567bada34d216f384dc573012e21919be2f8242145e54e99991a7b1597f0e3977e
SHA5129a9432bc92542254db478750d2c8d03f277a3b7483b16257425c332d45600c75b5e0d35146047a08552fe629c6b97e2e0b18892886e80f6ff2a431aff9547302
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b572298ab952ad2a25b913c3c8fb1a1
SHA1dff31f435239a734db00dc52e67a6633ddd7c251
SHA2566b5b5831604e3852e975f425d81543710b2eac4985ab54dd5a740b2fe02c3c04
SHA51226064fe32725fc12c07759eea515ab96423690a04c6ebb8282f88a7fd894e60b27fc57005695993007e9928c63d24a3dbd9c14a1c870da74347ed00693629e96
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06