Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:02
Static task
static1
Behavioral task
behavioral1
Sample
7509d1ec005457362950ef22b81fa4b3.html
Resource
win7-20231215-en
General
-
Target
7509d1ec005457362950ef22b81fa4b3.html
-
Size
6KB
-
MD5
7509d1ec005457362950ef22b81fa4b3
-
SHA1
0c8665959275c21d98eccfc7992f4a608db0594c
-
SHA256
e158d6c2294e3c0a82123165f0aa5d237d687ddb4bf04ff9442f9f4bed973ed3
-
SHA512
8fd5d96f187b7cd5199bfa921869d79d6da07d31352ae231c1929490143d351e8599cd8bee437af98e62c50b9b4326ee84c0f029ee7dd5710a9bfe0ead08abae
-
SSDEEP
96:uzVs+ux7Q1LLY1k9o84d12ef7CSTU45/6/NcEZ7ru7f:csz7Q1AYS/r4Nb76f
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412364013" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000799994f44d1724fddddf6aab451017e02400ecf9c9afe4190a9ac6a4c53430cd000000000e8000000002000020000000d763fea07410eec829a7e502a339daaf04a91ee2268ed18664f0e1fc8b3d8eaf20000000a945655719ee2c460acf5ec2b65b26652c5d45c2a8c069ca91ffcceac5bd9c6240000000ba35bbcb6409c9f070d630a0ff3fa5c8d250c81eb818b2fed160e36641e96b8bb346935c9e0a6f631fa7aa6c3fda639bb45aa2f13a345ad7c6616d0795672e51 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81F599E1-BBA3-11EE-AC0C-EAAD54D9E991} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000ebe44ce10b89c0dc9edb4c79607e9286ab8afdaa8668eb94606c2d7cf5bf423f000000000e80000000020000200000000b91ab141971c3758812632238d65c11d87f6fb625aa62e483dc1c8afb1aa7c6900000008b4c28c40d80a22c3282d5ea81145c55c2576cc78ed0b868b355ecb2bbab6867f81347816b817699984b5b0a8de9ae346a01e0e6ad2a5bfcf43ea3c84c2b4a4100a1fb113a22699e3e5bfcd6325534348d8cc11fbe5a00db0633dbfcdd0d872889b8f8b3c50b0f2e6ca1e4f4e044882391aff3e32d295990f509723386dffafe13cf69e712670977f6f3b28a8ccf193440000000496ada8d895a4b11eef2cbb6d07331d63f235c00fc149b1cc145e805b1e27208056007c3c7dd537483023e1d01b7767b0b1088988f2b5c4c2ae197c5aaef1221 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40dacb6fb04fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2096 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2096 iexplore.exe 2096 iexplore.exe 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2096 wrote to memory of 2476 2096 iexplore.exe IEXPLORE.EXE PID 2096 wrote to memory of 2476 2096 iexplore.exe IEXPLORE.EXE PID 2096 wrote to memory of 2476 2096 iexplore.exe IEXPLORE.EXE PID 2096 wrote to memory of 2476 2096 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7509d1ec005457362950ef22b81fa4b3.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2476
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55c65952b8e4692befdb6f72e4a514275
SHA11574ee321512b428fd7bc39b3c5d30e236d30491
SHA2563513883090dbd89e738a66702192271a4b68d7335c78e34f523c4d6b1ceb785d
SHA5125d22dc2ebed2eb75fc74e748edaeda651c83099757c5654268eac5aaa67825c0ef37220992507b3135ca3132e34be4b1f0b6e819bb7a79fb3ab18a1fde024eb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5a7c9b60c1fff3469aa7ea15cf754c1f6
SHA13a770e8b9a12af58173ec2a65cb23a559c49ad9d
SHA25653c1b533f25669a60ca28a36137e72977633f99860ff889d539b5bb90d7ad8b1
SHA512410f8b827b38d641c633e88f404a7aea3dfd010bcac011d598204e518cdcf112c2ad7da38d11db41acb586eaf9daccfe816e126c834bbd878390ce418df0422f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50ba48baa255005b0bac89128268b03e0
SHA197603f6a05a5c8c4e0cab1bca3d56eeac500d781
SHA25665a4305c2eba2a8b7fd49c6ed68f0b664cf1df694bdb13177c11ce42be30a5b8
SHA5129cb12916f38bccf948c6813c3507618dfef44e299739ff34fd40ba94880a7b00743b6b11be9d2d1bec572ac2741bc05fcf1f6d38f8f8da45560afe9844374117
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55f39c8e8ede3c2a2833c00a7b32a00cb
SHA1c3ac0d6202402a56609938cb63eaafe7234e1e14
SHA256686609c6071a30c74b775ea6f0cd2322b970c32de92b358b9aeb47f7909ab141
SHA51236d540d61a19358eae6c197aa42d54fbbc391a3f586de97ebba451d6117a5e3251c92ca82d159dc40d53469c488d870910944c6941a4d1da2336eef3da240f75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD565d33c0be38cc2d41c83e174c4e3f12b
SHA1b662bdd8aa8e660815d4031a088e202d523e1cc2
SHA2566122ab42d665e913c72892e28c1806c0d145d70177c90d70188f7c4389264046
SHA51213496eaf47e610e4f58b74a30644e2977c7e895cfd08c16879687720ca6e1adacb43fddac1850c9d4e41add7cfebb90e66b196313e425c96e4a0c994a726f766
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52a7203fe342eed6c7e96d49e862ae958
SHA1bb48aaa393d5e84d82075205f536062d3eadc57e
SHA25665e751b535f77b2c0d4a459f302038280bfc39ad3e86bfe30e78efd5acc91ee0
SHA51245c01347caff040b237bed26be2ce6cf53122819b202b88510fd7a4d2813053bd141efb0dcea64faac5962a3134917098781d4b6a1de0d4272881c6c1158ef54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51a639d7439fd1f9d945a27da574a776e
SHA19bc55232f2bd5be4ddb52caf5b889cc87ba327fe
SHA256874bcc47ce895b98c40619b858c397210b3bc48d7292ae84d7828d606e15932b
SHA512b075317cdca2b78a2858554c83252f7a41db9a5ea0afadac26562cb4e1a1232d504a97879f6af51acc36dbe6c6b8ef51742a78aaa0124d75b7020f988bea7273
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD554b3fe218de0af3981e72fc9856dbfd1
SHA168a6a7389c7b611e0761c7e94e3258cbcd1e4b4d
SHA2564cda2fcd5ccec3b7d04fe57fade13edacaf21a904e506042eac313b6117fb30d
SHA5124f973cca6d360ecd6a7262a14098df769a876f1d9d047e61043ef8a0ac54d6d6882aa6649e7dc32ff727c4e162e12808812ba5c124618283ad61c28d3544ffdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5599f0cff8a82abfbac170ceb7f7c681b
SHA1b7b5b143e22c60cbea0aea653d54675730597c36
SHA256d910a5770eba94f4731902f02286559007314943246e43322f1e3ade273f8701
SHA51285ebd6f9d937c21ee1a4b94d300a9decf5c4bdde9d1d0d2f009cc11eff237349f7060f484b285191da612f73714e9fb84310e60f389b9a16ea92de612e003a42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b3acb1972d25e197a83873c9c6646570
SHA156fa63be806ff433e4f0ac5337256debd6af1c46
SHA256120fb05cd033dc50d113a8927a50394367705b4b2e603e817663b52a741f768a
SHA5127e8999f498ceca59602fc2ea88bb6250e971ff1345bbf41fdd76bcaab1b169325ac0b2361896361bf79817296873d71106ae1ddc574a851f042b392891a61f03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD536278d1f4eb04c6a64b9489ebfbe9cf7
SHA10a56cc1e703fbc7bb7635c98dae1924bb53aa24d
SHA256b872f0a779ce8399b0cd44da3c269ad7cf862bd56bac7502b8896a6bf0ff5e07
SHA512430f51f683ded460ffed2d377de2dc1c8a0b4d78a49670029466bbca057912a35202cba5f315644c4c2210585ad20448fafa5b4a1ea12121a6f801217f3a7ffa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e22df88391901d26d8642b1e5747c585
SHA17781ed5dd7c0d2ac4499dda4a9e8cc9f6c364cdc
SHA25606ac484effd68fb9b6008b3375b19f0e03df57a2fe1b316fb1925bbe1ffd4caa
SHA512bbaede8b559b291a492de58fa0c4dcc5bd7553c52864722942b41621269e6ea709bec9e2a0a8254928c9f26932435b3c47744516bb56fe201b5061f40998c48e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD538c2e8551fb3d216d50a1cce1a5708ce
SHA1af6c065c7c66583f338d02c2288ecfcf98922cc3
SHA25618e226b601c37241afdcdfec351f4c75f227ddb7b87d18c796ecad9ce27348f4
SHA512d746657b012e036afc4946174f5324af4b20d5c2a7eae6b628e8cb3f196c0c5c0897b95359d593ab3dfba2aa76c5f0dcb0a9c7e66a3479ec56becaf82daea6be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD596b44021f79a991124e97c16d2dfee57
SHA18d1949ee3ec5a3b03dd7be508c1ffbabf5684967
SHA2565fa5f929b8f5f5d440874882fca98df99bb3a80afed95d86de3e9e244e928be8
SHA512093b233fd8af42d897446ef8e913fafc8ad448527e363b7e0109402254773757a8e7297e425af787bd8dca92abd97df6fca1897f258ca4786a73fb317c80cf4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5327e4d7643c38bffeab08821cabb727b
SHA14168ce650b89ff4aa8efce64cd7dcd193f4023a8
SHA256a400acffd771d68d12419a427ae494e2cab32bd30d404787fb268d3115c62066
SHA51214a3ed1328d881797c2ff78a0d8e29d338d303cd8e9813b3a5dcf25d594a8d8005b8ac98a7a93a0f31f0c459cac732857d191112f27a0e431fcf6c538c7d53bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD52a6e76181b648825e7db6fd3bd53d560
SHA1087f13b52ce6aa0d0137d5c1a9cda8b80d111055
SHA25621614f4f20f0eb26910d024ee7ca3bdce4957b6847f1ae867e2c0a3c7c0f9f4b
SHA51270e3e879168b2da85b4fb361b624a5c57f69a8a958d467d2c45feb6901de3d58aa96848a0b0988700dac7b0863627e445b74cdfcac2f3d8cb717c145d035d0cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5b1f4bedd4b4874b6b316357fcf941f1f
SHA12020b7f4b8d7b5a60bbdea9ac60265f57f1f6999
SHA256984b01feff0a6bc7863ab5e90fe2a69dc1390ea423aae9a52cd4e3b935f6429b
SHA51228fde6adccd94e234b6231e9d4fdae543d0a447409065a6f3e3cc6059dfe05e08f1d33023f13c9974278f058bc7dcbc8be3186d702c4ff5f6b18c6a5aa6b8a94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD563baa96cc1ea9ed11d338bd3133ebff3
SHA10337af87b65d2acd38da547896e9b02af5dd6b8f
SHA2562ca83af9d7fea7d9c3032aa66c86aa44ba34eaa8536b7589f9261d71ffe61907
SHA5126291e25f3da7fccd768c1b68e221a599c5a4a3a97219851a799724065e343f2b5944f802dc38758d65062440f6bb589c4a8da7af1a6ed14784ad364151d7176a
-
C:\Users\Admin\AppData\Local\Temp\CabC32.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\TarCD3.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06