Analysis
-
max time kernel
117s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 19:06
Static task
static1
Behavioral task
behavioral1
Sample
75480ca55609e4b8fb28aa04b929426b.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
75480ca55609e4b8fb28aa04b929426b.html
Resource
win10v2004-20231222-en
General
-
Target
75480ca55609e4b8fb28aa04b929426b.html
-
Size
11KB
-
MD5
75480ca55609e4b8fb28aa04b929426b
-
SHA1
a79d2d2af1f34d4d0de061caf67b924a359e5315
-
SHA256
e74a0d45db99bfdd375af7ab7e48b58246dad9166e73c2e67393049944a296e1
-
SHA512
1f5a8d879e0a13452edb4e68f026d22e87a26b8f38c001d9d4ba3f0b297427b21df5ce6844215f7b782fd5c739314ab30bfacf8b68ae521c40778389e2827d30
-
SSDEEP
96:uzVs+ux71MHLLY1k9o84d12ef7CSTUIGT/k1+pEooYPiTe4nsjuFsrlVHcEZ7rur:csz7qHAYS/92nATeau88PHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412371465" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DD1B0921-BBB4-11EE-8FC2-4A7F2EE8F0A9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000003ce881ecc1bb2e2cb19d7a125649bee5802001544b8a761979750a6d4406a039000000000e8000000002000020000000685cac98908c7018a9ea32d556014075e266d6a255c75bf8ae9771f3ae3135a2200000008e1b3e322facfa4834eaf3fa70b25af0c3acefee55f51a543014a67ecbc8e61840000000240edf2b8b493a75cf9ee53ad5d85c66b3a277157b44a96475b9ddd7fa9244027690ad31d6949a6ed48d91ec2aa0e86b3a6cbc50f352f485affa8ac1ea9c2bc8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000079d489b7ade75867b3ace50055d29f2441ec08798b4a80076450a3758f44b4e6000000000e8000000002000020000000f69ed46626def2aa417d2238fe440517bc25c541b7712f867303149ab6918d4f90000000982dbed8facb01c9794621ee815e7c4f742e07e0f2ebd6070590baec38567654b25b05b1bc01117a059610d505c7e61890372767d1245e5c397a6d82009b75f16a433bcebe4c703c234a56e66ef66046dcbb72e1951536af55ef7d3e1fc2ef2b0a142f92da775836e33c6e4d57c0c59bc27e0f17450e9c5c9a2dda813ba3b8d7ff90487a7ebcb73c0dca84e42efb16a940000000e16bf54397ae682b0474cfa399ec0c8d4326545744a7610fbdb65768097dc0c50828869b314a9c1809f9f16395cd7afee7afbb3bccebdda187aef9f0cfea1b26 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30201ab2c14fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2800 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2800 iexplore.exe 2800 iexplore.exe 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE 3036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2800 wrote to memory of 3036 2800 iexplore.exe 28 PID 2800 wrote to memory of 3036 2800 iexplore.exe 28 PID 2800 wrote to memory of 3036 2800 iexplore.exe 28 PID 2800 wrote to memory of 3036 2800 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75480ca55609e4b8fb28aa04b929426b.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55eb394a2c7c517b1711d9779625a8c46
SHA1db7c3acd87a46cb857a087a688e3cf8558e386b2
SHA256c9bbd7cf23db1199832aaef69cfbe7de2a92d8fca435a26e1a6e371995d0b2b2
SHA512ddef54d405c89c73ac72cce1b1d96e52b951d284ae023bced670d5b749aec2e7f4824cf2840bdfe86696ffa88e425ee9a55f4f866f8c3257aaf1034be2857758
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562a8230bb73832b3e7392ebe7d909614
SHA192b47cc45943493559609426924c59aff6af14fe
SHA2567d40c8ddeb13639e467df9b67e64941a0a966963acc1288096046ac085f4fd20
SHA51267e6a7c445411b0e48c5f1f3322d1cd4b535bf4e459e49d25e65165927b9ca67b0c9124cc48094c4c9b2f5bb8c9e26e4df5b6b7b0d6a5d161bb2d672d0114e5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0d864b3b12b2d69857fa4daad15795a
SHA19d3ec0d1405d85e9c2d090523dff064b104fc516
SHA256500961614cdd5e1bb95211bdd42a170d285156306fd5587790c8c3dc6a6788a6
SHA512f1c95568a91cd40f50dfa07787217d815a2fa4d6205264f8bce98d8f43688602b9d68a87253b396cf1b682abc9eea693c30aae9fd29c01785e39ad3d2b653ddd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2a5848d759684c0f7f1c618444b9375
SHA154f4cea9763b62d3057e069a5c914dd46c01b81d
SHA25666adffeeb57bd1b84a97e5d2ef4d34b82f4949b105682471515140d5957448ac
SHA512dab458354847b2c7f1fd2ccd19dee14a3a9a03e1c34868c7ed4270dfe974e77e79b5b735680d791d4565e33de2244eca169efef6a22540b872765d185e3899bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5550f9236129b4ba3af11e7d340f6e588
SHA162c3223c8e7dcd3fe4b89842400812d4b75309fc
SHA2565fde2ad37b1ec98288c799234a184f41880f2c5d2ea2db139c309b3a9d742e75
SHA5121691dfc6e45d1880298d8153761e3f43193628014fef6b09935180a3501483b5cb29cbfbf2e7b136aba80511c0921fcd9443b1e6dddef5b0ffd8a19c273cee78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51006b50c09aeb9636309741163a637b8
SHA1ce3e8c2c01f447a4a029002a51b143226ad55d84
SHA256ec51fdcae490c623788df83f4ec8894d04f6c718cb28303b9675fd41c276b6f1
SHA5127ca74d57807742e781fa948fc445995fcf576f18f9b5cb866b9bab9bfd44cfdb83346963380629a6fafc795cac4e75e8c566095abda8c7f7d75f204578c2f795
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5007673687070a2224a2f3d2e0594e570
SHA1686cb44a398d97ceec3ca752d781caef3832aa4d
SHA2569155d23212b145a669f9fed8a9744a4e4438543c81f05f5cf51d143b7d477584
SHA51251bc556788df177852aae2c98980494c9689b14979ac2d11d9440a4113dae00f35a5ca3e90a2cfc30e7b70a14fa38524ed5499283131203a09ddee1d70b6fad0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd957504a5477cb95e45ba9517162671
SHA1dedc90a5b32fbbb865950b38a2bbe09ee8ca10ff
SHA25615f1700d72bd3a53d5621903e66589b4308f54fb6246ce3853f02e7d03efd889
SHA512ff9e58c7bdf20514cd0f32134e94bdb1bb6c2d40ae9d1c132f81176288c7a308c81c7084c32486d8e79246208c7861cc9bc460a4d222ec3af9f01f3733c6f853
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e5f1cd5bc342dcd120d27213f273558
SHA1e60aae280f4722a014001977eba257bd180571c7
SHA25694ee793d69deb724602644db48798beec7101ed8a7f45057e55b2ee0aa0d441c
SHA5125f9dea2e91072a17fcd717a21fa079309a8b8dcc605234a17f9245e5d2a61b8d36e7b47cadb859f39e77ba45a0e967fe2d44761c9e36f00266186e4de8242ffe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552b6731c5ad91227a9ec4202bd4f4abb
SHA1d1f1977dc31681dbbfdfb0c2eb8aef81c7edc49d
SHA256a100d006fd5a4312b99a5e9818d55dc42965ddb649ec25ce2442abb85430f558
SHA512d87e95df0712d76debe103accc2e45755670f799257327b206b746f63f22ca750bce187b1057acf0f7ec81e610e7725ffc85ed05e83115dd0c834d1f6a3dd73b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59670b96451ed15997c47b6630a1fbda6
SHA1f66e3a630156fba897f68af31a5a4b23eb5bb160
SHA256da3dfc144d6b832e349f2f16ee5edcf4b988bc1256f8229e4c356bd2941d5574
SHA512e1befb1f32ce1b494d245c99c80fb15ffb604996b52f80c6283b25dac5683024311176803a2cfd7a3fe7ae53a7d68dd18375cccda88227ea259eec6359048dd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524d163cb84ef053de97ec59838ee5b97
SHA1f452e275d1e31a6b5e5800844b07e8763658975d
SHA256ed92c31526cf7a6b78bd8c6884076f1851e4e1ad2aceeab9bb4be165cb6b7082
SHA51217ba410350dfc1f942c015507d43abeaf76e225790fbd6102d6a9134951266fcba5fd70ce202b796a372f86fc738a66f89098ad8b89929950eb2e52e7148fa7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1ebfe55f94e1d599dda16dad8c15a19
SHA14d3f949febc9d0ef672313d5041e83a862851d04
SHA256c5c24f975e5a9fa73bf48b191b6ff6537d0f31c55a44d487220eb9ae310388f8
SHA51292f29b685151d9a4aeb01abe0c7f8cde89a7c8286b20e555f7c89fc98e3a96a64295d8e163982292b1a9407db70b7536bf92fd87d0fd37f6fdf4f2152cf0ee3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516a7814e7875515c9357dd1274ad0203
SHA19201f69868f30721aa8f194432ef6f1993c0f9e9
SHA2563e57f682535f282c588db0b505e62af45bd1f8a9e012554d941cf5ca8a625335
SHA51264e7e1b2ff4856230a2197c909f95b29f42b59a30ea895c4ae9358942bd660692c2dd68e64ddf39dde83660a705b86f5a7a9df51e463c96e6dca27f353eb6561
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eabc4b5d0c9480dc8173caaebe0d98eb
SHA16ef81a1a02388c64471475672114472e99c0de4a
SHA25675688cb84c9e5166d9712b6a7b1a55b207349f9a7a58d038a6b95b352de529c1
SHA5125b7052f41c1a43341af1739bbac60f49e3e6118d0f25f595d6d0075ceaf8764cac540bcf1511cddfe048d6be1fd8da9d633e9f121b1c0c07573575b793bdaf54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c894de6cde1841418ae2adf5157d01f8
SHA13a5004f6d74066a67932b0ab7d3fcb8209c7603a
SHA256d90d462d97eb57816a1ab5f6bff92b3e8ad7c377bf8d8c84e7fbd58bfe655012
SHA512b461c357a29385437a4f4b36918ae42aff4bcfff914d5434d6268b09364d250a3c04100559905328846fc0e8636608a16a37727da382f10722d8663f3aff4749
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f52edeeb93151387dc657c0981b95ae4
SHA1a423eb0e456b2de50c26f60e0f65ff9cd36270be
SHA2569e10018936042b5f3323380716e5a832d9ff836765f2d54a3e7c44015768ba91
SHA512f3b9b1dcfb33eea21cd85f83ccf74a7f23c182dc8245b34131c64cd6d23bb467a44aebe35c4db410e0bf44cfec5fb23366be756bfcae566fd048fc907f7c31b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fe076d19d2537871471d4ee5088d596
SHA194ada9166556fdca17f4e04241d4a31a6a933ecb
SHA25655cd9be7d6aa69657e5747b82a2bdbf3e1d45b0cb3f6d9980fea2c133ce88175
SHA51230ceea581f92d8289efd6faf787267c03c78bd4c1a788cc1a95a9b7e2c851a0f94b9d9bf9b1d0cba9a9fdefa7e6110fbf44c504dd14635520a4ff1a246b20b57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e72d0c18c010b4b22623dfa01d5ab88
SHA15e054e272b6c3c8f67c9d9bf8fab503dcfb69687
SHA256fa4987cb25487964e091ca6c28588eb19817c313aa19938803166378fcb1890c
SHA512643f9a33db72abf0f37ffece61a34a30dbdb8ccc8ca25d6806e3dbd08a9b313e55a046d2e32abc87dd4d597bd224d5de2bf5f297c9564ecd44f0dd234b64791e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06