Analysis
-
max time kernel
147s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:33
Static task
static1
Behavioral task
behavioral1
Sample
751abab5df48a22fd57c4b9afe68b0f5.html
Resource
win7-20231215-en
General
-
Target
751abab5df48a22fd57c4b9afe68b0f5.html
-
Size
57KB
-
MD5
751abab5df48a22fd57c4b9afe68b0f5
-
SHA1
2b01a2bfaca2423e5ce893ee58a4f52e00e962fd
-
SHA256
dd640070690d9011b4969ff67edef481b9a5e59f37ccaffca1e1d213baa58471
-
SHA512
75525be06a11ce3b7a65e3c37e3bdabc62a6066a0ba79976b926970f3b07f808cf1da8da725f94ac38077e8e125d65991413c550eb81f9c2096364f3806133bb
-
SSDEEP
1536:gQZBCCOdY0IxCEboXfvf/fDfvfofMfGfefEfHfEfwfCfgfIfvfjfQf9fgfZfpfvG:gk2G0Ixy3X73A0umsf8oq4A3roVIRhXG
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7096b8c4b44fda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000002e37890d8a20a92b7d752653ed7298aed370568c646efadb2bc93c383d2ca48000000000e8000000002000020000000dfac8c5331610909a79c4879f3fec0e1b00a39e218f33e70749e26ad5b19b0cf900000006699cbe4df694bee31cb2f35917e6ddd6fbeb6e5b9671a197460e5f4dcb5c77797e5e737e02b6d8e872c5031549a4777874730651e06f1620300517627128afbeafde1264c125883356c81865db8f995f2b1542151c5db388e6a60d8c3cd6ed141f266ae38d49931df7c8017fd4635f28ba9f1a3ab77f75d63b29f835ce2961d70dfd5b4a6fdac48662614ec68b36e54400000007710e1e72d8ae28b086326efee58ba2f5c1b512a78cd94c05addc5c3b0224b65565d6f086ab3c320057c79d2e7ed31194d23816215eea779193fffceadc0723e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412365869" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D586EC91-BBA7-11EE-9295-C2500A176F17} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000022e67519c7d2e693b52d99a60e9eaf9b5b734d0393a805c2355882df7b9c8ec0000000000e80000000020000200000007cb5be992f87c5ebe6c4692b330a567bd566edc1ed1600abf9780b5de4a2a5b1200000003620b1329f166d0189787a1e08a29c3fc12803b2d55cc4472240123065fff2d94000000042549afd1ae851c17b72ee8dd65fe2ada7a6826b3c9779324e76faecf315a60c444425f82f2703b971733efb0ffbc5250d33e5c5cbccd7408a0e0ce497910adf iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid Process 2404 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid Process 2404 iexplore.exe 2404 iexplore.exe 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE 2804 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid Process procid_target PID 2404 wrote to memory of 2804 2404 iexplore.exe 28 PID 2404 wrote to memory of 2804 2404 iexplore.exe 28 PID 2404 wrote to memory of 2804 2404 iexplore.exe 28 PID 2404 wrote to memory of 2804 2404 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\751abab5df48a22fd57c4b9afe68b0f5.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a8de8bbe27399d6ba2d8734ac40e1e6
SHA1474f79661973dd04ed6b2f723d4ba3a78c256483
SHA256410f3376c701164f57065e0b129eb3f5abaa629339b712eede574c03ae53668e
SHA51205bf712f45b3cee05444034b06a280a344e3d4f2bf31604faed600a0651e74c17a521204285a3b526cd0f61f809060553fce238fd42e9783c7baee845b3d9ec4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbc3c753aaa3f3dee4d062eb8df16dc3
SHA1f823a317d61f5c134de7b6f939c869ac5610e711
SHA256904ac7f10a01c3cc27a391b58c65ff3e532ebd76c356219eb9262e6199803ba8
SHA512885f523fcbd4ff3b7c89bc3a5d6d7f353120c2e2e0713d1eb7fec28dc87ec2d013a35f0ba4f656963fe533fbfd91fc966cd5fca1a83fc18e37791612b6b3d390
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50994efa2122e34ac43ce85afcd95cae6
SHA17702c9e57c683685c6184369cb48ea1d2025a755
SHA25683a65eeb6fc4d04196df1b0c49a7e30f3b902328b0b3058671f5bbee7a47801b
SHA5122a736e19220049c3f151cb277ae0c4af2db07062c62d77ee50bc69215a4ffd233ada6bfe8764e8b065941c024e9c5b3075df32471d7f8ddaf89558ab9d3bde05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f74ff4d29734f93fb8d6c29996a876a
SHA15b0821f08c6ce83753ec3fc5bb15cdaa31f2e195
SHA2564633aedf986b8647e939e5c41287c7422260745da65d12c15f90e8638e644d1d
SHA5120f4640dd09b5d1f88f635dfc8e4ed68cac1bf351ae4672c37ca0bf2244180c48c99c53e5fac0926b690156bbae78b91d65d38f6519728f2b742a7f8f224ff676
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52459c2b45cccc85a1eb47e13f28ec60e
SHA14767c7543c0b82af1761e09fbcda3e47d1caf4eb
SHA256132c4be1a30bfaa8345092c35d3634a860bd11c78dc4371845db316383159a86
SHA512eb8d9385c2bac9a15c482e6536a18e5f73e16a009f973f467a9e9ed479ff5e05a3c3b16d3890ca37089b28ea350b5b46ef5938616152bdd221bff799742bff31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512b32b54d22c12829d0c185cbeda09e9
SHA159542ab77d8105ec1478607b7a6ceb72340ea05f
SHA2563bbaec44e0847d5df7d9198c6d6b7234cabf54f8a33d3b59d2f5b3b122e5a4ed
SHA512dcba0370024fb8c195dcfa780ced2eb60f7982a7040f5d34aa737630a0482be539fae7b6837f3fb74c9da40a54c71404f2440c77755b686738c598f67c7478a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562bc4bf5b6751c28d571085ef80af442
SHA171fb8443535e15d4dda2c7785125717956e4734b
SHA256511f9172872ade855dbd1cf68a5383f82012875a42ffdf544d25d26e97f71eaf
SHA512449ae79a92fd52e86d5da3137a0c8694518aba3ac1d46497dbd8c42c6d8344316e267a8668f609b2f145751fa75a739a6a17f4d1df721889d6f1a56dcfaad84b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5006a045dd43d1560b21a0053d3bd4bdf
SHA12c312eeb010835aadf6036966e06b4c61cd30389
SHA2566128759a3dbe6b9ed3cf991ef79f00764faec282d50fb9b112b2b68f14434e51
SHA512e790e8b869c9eb437f1e1edd323438be1c2f3186fec7c2edef509585251d001d7e0b31d59045668b7283e27d811920338bfee8e88bce42491e946d3adc644801
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b3f85c85674655b68bc1f0fbf6e9f6c
SHA182b7c17825e2d913a1ee9f37d5614082e5bb0dec
SHA2567502c21a7945808c20317a9c8cb6df7105cd8f9fc30fb62517c712494d3338f1
SHA512688e8a496ec62bd23a4baa4e9b53cb4b5758e1f07e3a278b787dae3c5059cf6adf7d42358586e0773fb464167d8820c5029ff6d7f4def45c10691baaf9cb2321
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550dd915aad976caf45e4d1e9da000d1f
SHA12d992b1e48fcc3b81388a054d17d07c6bd9cf0fa
SHA2568bb8308c75b37f20631de84cdb4bb11a7dc004e146a72de1146ed15752c87740
SHA5126903a3e8857e16985d984fde1e113b0ad8bac6e8ffb31c49c6b153cfdae3c4c47831c9ff01662ee8b3ff1a4ba881b6e824d512def5cacdaa7ccbf549e0cdf348
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f087aef6e66d9845806291ced8d62b3
SHA15336423f619bcc0be35a44318a47c24825dcd942
SHA256a88a2d68891890732808c86cc33d1b9a24399db1faa2ae8eed9994c4fae55011
SHA512ed3efaf805281caa70ed52f1bd930f07f12a58ad1d9e311fc208e51bc07a63cb5ce41b9a9b58516eb19031c051bbe141bd245d85b4de2493cd301da4942e8ade
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513ef9836dc37e9a94a27734b30fa14e3
SHA1935846597c93e9a33e1d10ec01a6bf1d12d42787
SHA256f66bb979807d5756adb1b4591f7044f31691e20c55d37fc28b9b767410719b0c
SHA512529c6efc26850bac0f646cbb44c5e47efc4f54e5411e4f5175a54fc9a79f6f065ad497b3be33733858e551f680c7b23e63a44c653a90f9ac86b77bf01331b25a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b217258ec3f7e92c37f1ddde21a43077
SHA1bdc23fa5ea8dda494e03127f109f566b4f5c80ea
SHA2569100f828084f13802b8e48ee5fd16b2c9af7af84d337ee00fc29520762361960
SHA51297ac46c5393f2ef2f8d7b256d9a15aeb2a79a2ed85d20372a39490772388040173d76d5bc2200e89de230999081e20a1e36db8b973a4ef3d09acc7ab4dcede71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58003d368a97bd5b5724a6816d6513abf
SHA1549487c173de7722adcb2cae4634c63f1e643641
SHA256a3726c27436c722b436dce12e6754c6db71ef8a0448c7ca3b72e81e2d082cf62
SHA5120b0699ca48dc0e4062a6025a99e91d34a6e8ed5b0e06b893375b4c4c92a885c8cf59bb8b53674af7f58a98d9b3bfec89ac6e290417c11288cfce3a2207bd0038
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5500ae1a8257ece14d68f32bc752bffd4
SHA1e0a759cedbcb35e05fca09e98e0fef65cb9a0f8a
SHA256d0ed652c7c835d0ef1c488d07f86d5a16b8a9e5f76a669918d12e5677c4e7f93
SHA5125b6cfa542ef69a2f185919e561f7e070250b26c738df27c1f513e7b91ecc1435044ae04084cc2657a3ad298879ba73a6476937136106c3988e66acf43d836413
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a441a45a9f6c8e0b054ffb01e466e16
SHA1f45bc10bb3d5d14ba41b4ba8945262a7dd7cb584
SHA256015cea03a8577f86852ca2a8597ef32aa85ec4e351e2c77504bdf58168960a45
SHA5120af853b1c4cdf69501468fb4db11e8c9dd99577b24eb89d25b79b3297e2afc36a7ca2fe610cae6fc3b2c8bbba6236283eed4871cd040c2bdd5dd6ea5da164482
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1951fb688c79936cd12149a22687ea6
SHA16cf3e4a9ee0d0622f142cc5195da2ed04536be4d
SHA256654828b8d4937cb970a88092ed3b6ae1fe7249bf91d23a9dd9e6e3239a3a1945
SHA512d6c7da5f0c3db6b31abbe1d46f1294a8bfeafdff6bc7be710809ec7014aed61b98a900c123f30104451e2cc0d8d1275dea116a5bea13392d862f8e1bc73871ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4568ed50ead3d0123a25b8320642b6e
SHA19bf6a17d4f60b1fd090584b1e16f9063852c8097
SHA2563b0a13dda1b7eb2f471f3071279a7bddab035af1fd8bb07c2ed562682f89097a
SHA5124e0ba1c4f39a48093d661fc728534aa1d33dd7310f08d86236faa5845e4c04d4d18cd14706241d13ff0bf77a3018973ffe63ff5cb3efd73180396e31c3b0a727
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06