Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 22:08
Static task
static1
Behavioral task
behavioral1
Sample
7883f0cc05d1bbeefec77ee5403b9c33.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7883f0cc05d1bbeefec77ee5403b9c33.html
Resource
win10v2004-20231215-en
General
-
Target
7883f0cc05d1bbeefec77ee5403b9c33.html
-
Size
42KB
-
MD5
7883f0cc05d1bbeefec77ee5403b9c33
-
SHA1
a938cbfa1e7cd6dceaba4db0545f9ba9c8ee7b5a
-
SHA256
36aee28dda0e7f8a7353d062e6959c38682707901e831ba94062f575c102c91e
-
SHA512
7c270dd8c94bf49cd8e1ae7d388b26e85db46e3ec9335862cd19f12dd6b25f718a39389fac4cdc5c37cc3c36004ed5e1712f1c21a4b0a52d4ca802bb576cb54b
-
SSDEEP
768:q22vyq38TehmDsgRyq3iviqU6SKd8ryb8FDQdjdnvsv:LqhmDnmvih6GybK8dlsv
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31084708" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084708" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413071913" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d5ec7ea450da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1436959839" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1427428224" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1427428224" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084708" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ead97ea450da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ed60d6ae529e0e4187beee4fa1d8750f0000000002000000000010660000000100002000000090cebe300e824957f65e184c4301fcd1c56cb7083e8f8e92401be05f0607b654000000000e800000000200002000000000f794bb11b63824d59e29114f216ee31e677beea14af47ae16c7bd0a98091082000000042eb0521bb7543c5dc12e708babfd4c97ebb4efc8c719c1e3e722e0ed240935e40000000557e67f4dab4bbfae848d152acb63dfaf6d47fda7522f37fcd68d9f1755a304ee7d99444950bc97c4b79d2537dec9772656cb49c55bcbb8620498912e8a47447 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{809327FB-BC97-11EE-8024-72AE6231743A} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ed60d6ae529e0e4187beee4fa1d8750f00000000020000000000106600000001000020000000c187a838cf4a87c90d5dbde6da66b0291f159655806204ee1c35303c277ca9d9000000000e8000000002000020000000e2d996e9b376332bc59e51adf754d78d2642f336206c4a4f22f015bf78ec309b200000007c1b67a3fd7e7c6f3e1c8a822215308a500d5f73492a054269f11f576d76d0214000000056374c5c9b1dc528b4f6309e52872ec6effa5b6ee6a8adf017fddc798bdb6445f4ca9214c8ceafde8965046ee0a88f97ca333267aee45bd527bfb34a4847803a iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1136 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1136 iexplore.exe 1136 iexplore.exe 4120 IEXPLORE.EXE 4120 IEXPLORE.EXE 4120 IEXPLORE.EXE 4120 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1136 wrote to memory of 4120 1136 iexplore.exe 85 PID 1136 wrote to memory of 4120 1136 iexplore.exe 85 PID 1136 wrote to memory of 4120 1136 iexplore.exe 85
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7883f0cc05d1bbeefec77ee5403b9c33.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1136 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4120
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5b610bd5c61e2121914699e4b6cb9f7f4
SHA1514f5ad7770f18e1c5b62253d95d6aa3c63c83ee
SHA2563a418958f81aae04aa13719238c42d24adc5258b95246b3df0b32a1bf7676b51
SHA5129ebb50a5b4942dfbf1a037e8a1b6308502d5bd337abaf90cca0d44f3a88001b25c6f82787f13b2d5a6f2bcb81209f831c16422d4c1a6cb6e07d55e8dccd7b3b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD52bf3d05168247b85762ac2f45995c19c
SHA1c188d43e4b97e479288923cbf4a3599950246732
SHA2566b4d88bd7e347526efd22d6f07434ed338046d35834bf6b8ad2fd3050fab101a
SHA512c2d9d21dbe1ea23dae9fa0e777af93ecd9ea4ee923a793b59afd0fa38bfb15f1ebc43774037bcd797eb743016d7094de4a36dfabdaeb16d8a5ddf04f26829705
-
Filesize
8KB
MD54db8f8bfccc0e7f3f1f3c042d2c29f0d
SHA1e1712880d0c05c3ef63b29a18fc5b7bf47d32ac8
SHA2564e0d2981ea1ad308dedc5d8fd67a8be47ab6fe66dcd3d04088ef7f5e5a14f8dc
SHA5126ca0ca33de3fd56a0bec5de2f88610fcc0fa9160736c7a905b3997190714ae9232d4ae8ef7fbac17143aa95e121c91fc7f96f79fbab694df89e72cd6f5e73135
-
Filesize
129KB
MD57c0fa0fb5f1f8f932632e285a259939c
SHA1a143822149f96874ce45d0a91d53d8f5828cd0e4
SHA2568401ad57bce19def9c731e27799b18821a4596a09a14f3898e4bf62e3c399e33
SHA512af00b10b8eb586ccf7b1f0173d5e69c08fdedbe935b1e28afdcf2c561af4abb26c4bb1bdf953fa3305a56ce66c5eb86688c63f0ae418fe72d51eee42c9c8df03
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
18KB
MD5429e0c7837d1efe711d96b1d27207edc
SHA1cc1aa924683f540aff5a5925ae8ab229e585ba33
SHA256881c3fc75e5f88389d75ab91141d2a154df3fc741f6e84bcbb75be1bb23634db
SHA51200a1bbb5096591abda88fe00fe6d58795b3e8c68e74e9b040b395350122f919a5b9efdb3bd2ed69f53ceb2a6f332244abab8e304ee432df36f02e2cb0e0e80f5