Analysis
-
max time kernel
88s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:52
Static task
static1
Behavioral task
behavioral1
Sample
7503fc3fddf8c6ccadd452d0e2558d85.html
Resource
win7-20231129-en
General
-
Target
7503fc3fddf8c6ccadd452d0e2558d85.html
-
Size
61KB
-
MD5
7503fc3fddf8c6ccadd452d0e2558d85
-
SHA1
59e4e8c5585ddead20104a85b2ddb1cc1aaf4fba
-
SHA256
1e86a7abfe9e2c6076abab61b24dd6b92b81ad2ccae1f5a19a29e7ef2953d9f4
-
SHA512
3076dfd4e7387f3c11e9a4f9ddf983a81989285e1b47a87c4e0418573f1d6dd2c4bae4e08e587523859e5863e4525a79cf2b43921f21073e759d5d365fc62a6c
-
SSDEEP
1536:U1GERGG4jGUjG2o51C+8DMONgC2zNFjWq6ghj+eZ0zZB7BO80SLCy86KsTR9Ru0E:86ghj+eZ0zZB7BO80SLCy861T7Ru02Zj
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4003182357" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084462" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4006776515" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0217bfdae4fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412966514" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001d74fdae4fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1A269513-BBA2-11EE-BD28-7E4216712C33} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31084462" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4003182357" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084462" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046600867cea8cb4995f7301d78886de600000000020000000000106600000001000020000000bf0e045a119d91e2f5399128157d53360eda401107ff9286ff0810690b0cd287000000000e8000000002000020000000b7bb383383ae358f2e0e4a27653e30d56344c29fc56edbe43484c4c84a7cbec9200000000bac0a532c31ea98a8c2daef7ae23d6e20656bc9838ecde54fdb42b0ca52c8b340000000ec400c58495c8bc88f3d8f48af65d5b74fae239270a2f4a43ee93d2911bedb135c264d0f825552659dd646431f74ea72e170a390e3b65b8319d8afb765a63ce8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046600867cea8cb4995f7301d78886de6000000000200000000001066000000010000200000005c416a9fab594b1036beb7f17baaf3ca108300d0a495034ef0d3f4bbb05e7dea000000000e8000000002000020000000fcfe3bc8df9b0667abccdd7750f1cc79dddf28dea8eb86a262913eefa8be1a0d20000000465c5488ea76871d056e2bfc5412a5a7c4437433a270f1201e7fdc1fe83256a640000000c9d680c94563bbfa77edf11cf3a724fcde2dfca0111be7c2dc3c4cf8c6111773ddcee7aadfe73b5bb714aacac6651a034397f8aa109c92b8e958d45bca6b3ae4 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2056 iexplore.exe 2056 iexplore.exe 4508 IEXPLORE.EXE 4508 IEXPLORE.EXE 4508 IEXPLORE.EXE 4508 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
iexplore.exedescription pid process target process PID 2056 wrote to memory of 4508 2056 iexplore.exe IEXPLORE.EXE PID 2056 wrote to memory of 4508 2056 iexplore.exe IEXPLORE.EXE PID 2056 wrote to memory of 4508 2056 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7503fc3fddf8c6ccadd452d0e2558d85.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD51d7f25dc2d6699e79619c31ff8908f6c
SHA1de3c1be6c3f3e7f6eadbe715ae575794e5bf1221
SHA256845c8a47772a9c534cf13a177c83c40db250a6dbbd0a369401ea884b8d058d6e
SHA5127a6e1765a31821e79b766ea0675ed17d735a40766d5fcd6cc305a8d33b8257d11e492d4ad8626f2909e1c2c2d93e8d04ed133effd0a3ec29324ec3ca36a22a1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD50c917a7e2d12c4b7816bad95c9700af5
SHA1974324df1d4a3e58edc3b6b654e3dc73a2dd9dee
SHA256d99598651f618d439eb5ae4282603904498d85e646ace62f64165d7fb91ecb9d
SHA512dcc03354c8f209fbbcd082c5ca6b2149409197360c95c4912ced7e3d56499642977019d4f58c833c54142cdf498b65335ce34401c8a2ee4c737cb163d2504fcd
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\custom[1].cssFilesize
23B
MD5dc905e8a035c135da58dbf3b2e7ff2ad
SHA11bd78a6df2336c4fb311311c5c381e02ede71dd0
SHA256ac53f1881f7a8792b927ececbaa641e4e84e444307b9298ab8dbb46ae15fb47f
SHA5123b38f9a4507d8431b52e840bfe922315a18e0648f803f4d793f3265d25f065b305add7b9e0ff3c9c7d4d61fdcdf8c8a030092879599e9274443363a2a6b0dff9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\styles[1].cssFilesize
235KB
MD5e2be8409e8098e0febda737e80206979
SHA19dd2a1547a32185443f259928850a48c6bc5c3b5
SHA25626685cc843764ee7346705005f064dd8713136f03329f608e2c1e22d736f2144
SHA51249417d7f7da6552e26f8cc19ed4eee322e4dff354b3ab51722660cf11516dc929e85b633ef0e52f6919fe7e34ec406fdf0ddd2ec8dc240bac623bcff18fd4e79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\theme-icons[1].cssFilesize
85KB
MD53de97749522dc12c171566efed590530
SHA1861322ff06eeb59163dacecb2d0d227b4eb4eac5
SHA25659d43dce8a069d2d799e59a960f26ac5182dfb787af873589a2c4335b12fcc16
SHA5122cca174466d8e8ebf5a9667d2ac7fb8a8de6252f4315857b459af0c5c32c0fb9d89d64c5131d80c511dad16bf2741eb6e34174c6c96c56bb4fc4ec9eaf00678b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\components-production.min[1].cssFilesize
106KB
MD5df1002d6e6d59a3cd07e2c5a16c5c08c
SHA10fe69644423f3b8592bc3812aa695c8c1c17ccf4
SHA256ecb680c154355955f1e477f054996448d1d5e4d693cbf9d3cf2d83c2fe9c7cf3
SHA5123eacf43319b19618b26be78a35aa2097c536de1aef1da2a3e57bbf2a530a3ace271c3c697d93be3ff1e20df1b5005de710082afa375e87381e326161365d5aa7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\media[1].cssFilesize
287B
MD5181954657e6770898122ffaca48b3cfd
SHA15d25f63ff84277321a9c8c7bbc159c6eee1f9fef
SHA25619f23910596a7d5ec990ff741ac54427765c0ce4a4c08b0f883cda304b075e25
SHA512da4f1b17d0f22fbdf38c4eae5c0e11d75f78d2fe005adcf1458c0924d6dea065b9eaae1c7f02c76c674d8bc5edd6bbd8daafddc3733f8bca3762cc1b5c45ada1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\theme-options-production[1].cssFilesize
31KB
MD5161012bd2bcdeeff98978e784f87b587
SHA11b66feab9e8c16ae032542c424b624d4d8f2b6b3
SHA2568af9bb8e0e9d5ec8aa09195dac1cca3f260eae2914eb302a232a3c0e5ed8696f
SHA512c136482e6dbdd86728aace9f67741b9908e43092b8228524b5ef0b57e5c1cba246ae304822ebb3a2a41b220a416898411f64677ee130beff8f4f1573d552dda3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UG0DPB4T\dashicons.min[1].cssFilesize
45KB
MD5cf3c0e8f26fe2025a0f22138ffe30d53
SHA148303b67f6e472663b304f9aeef59f977199f492
SHA2565c68cf1f0dca577bf260a647a1e73410fae9b838e3da448412df4b142e4fc123
SHA51227edcaf646f18561c9a8a320337be08dd252d339d136dc6a431dbe144ba80ac69d903dd8cb497a45845e9ef4150db079add0a50ed0e495a4ac0ca730c3f24763
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UG0DPB4T\formidablepro[1].cssFilesize
83KB
MD5673c027192ae550449880b442f4411f5
SHA1c4d9617fb648d4e6a4dbe0c293ae5c00dea93653
SHA2561a15ed9906d917d3bec2150aa3d53a5965cf6418f4b83e1155609435e0462c1c
SHA5121680ccecd05f1234e6325bd81fbb60fdac42ba9d13cee016a79c51e275f279e4ed3e61ae9d34906d7318669fade185b341c0e5622d2c058f63ae4d185c01022a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UG0DPB4T\jquery-ui-dialog.min[1].cssFilesize
4KB
MD5dae18845cfc3c211c5c6de92401b2ad5
SHA12dd43f7cd9c73e7d613de1f476d938cb5c789994
SHA2563a5dae1cd29a62322c66e2028ca668d50181b28c9093fda9c753d32cad93f708
SHA512af85ba1019d34e1839efeb9e989624f9fe49c40f5145512fcbd850da38f1e9b4cb3ffdafcaa59c30db6645a422a5fe588e82a2d4816a7b5587772ec34b7f89fe
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\css[1].cssFilesize
2KB
MD5023d981d291e34367565a41be9d469ee
SHA1a8ca5a9734942cfb0782c0a410d8a3e14d4f9940
SHA2568e0f77c0b031bb2e42f85d798ec163421cb0c301d5afbda6b6980d9907ef89b7
SHA5121664ba3b5463008d933ce790451797edd780f14e19b25b1c77616a7800715b21582d3e51fad643b6f80ec2ce926803294c22317d2a951a16469a6b2442776ad6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\css[2].cssFilesize
2KB
MD5e9eefb4f3ecd33751ab80feb976b9a1e
SHA104ca9c117feba6dcc42bb238de9e44802d69ed92
SHA2562d2b81f2594d07b060917695cfcb0cd22cadd3c11dd5306b631a8d581b8f29e2
SHA512d1f57960e1692e029382acb1f10498ef11c082757ee5879c37c1ed25ea93b6b4659995d0e0009b00c81c33ab042050e3be8551be2646ed7a80fd52ad424b08bb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\jquery-migrate.min[1].jsFilesize
9KB
MD5e489bd9969f80e9ba1ca4737179884fe
SHA1ff448b2771742c4477aee675f3cda56c0320a5f2
SHA256f6412288a06f5b354674ebf8b3b1c732f40567f536bed66d859ddf69a0ace4ff
SHA512f155e573e78d3f68a3df207774f74584baddf22dc0e31d2ae81a414754e9ceb5143ef9928c244f5d25bf0268eab008aa9f2d7fc7541087425a95d2b90a2a8bd9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\jquery[1].jsFilesize
94KB
MD5d2d3169ca79b3eabf7ca582222fbddd3
SHA1881b7010cbbf427b0d15b19a1cbaea97a3710cbb
SHA256132153fc8ff2cbe5c6cecc682083658bd1d0faaaa5730cb2b7598d63f8cbde13
SHA512ff871d41719cddaf5d46bc0d861c16b971614ef762818c42018ce16a0664afaa7987659e6e025a0be820503d02d34cc210a3c270ec798d840358ec984aa1fccc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\style[1].cssFilesize
600B
MD5d1df29a10f3726a15abe2ebbe388b6da
SHA19048f117109e5c9f42c307c4b7685d98948cad12
SHA2569ebad0a7a52b8e8cc9b4ce9e1f7659e220f4eee13334ab27d5caa3a06978853b
SHA512625db1ba4133dabcc1159d14fa0a2f583cc584aaf7a5216a4447c9edb30fcb79ee7264b621477eb4560ca701fda958f15f02f8e0c5ac75de337ea5a0478aa31a