Analysis
-
max time kernel
134s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 23:46
Static task
static1
Behavioral task
behavioral1
Sample
78b674a275dac1bf3aee7f83c5bd88c8.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
78b674a275dac1bf3aee7f83c5bd88c8.html
Resource
win10v2004-20231222-en
General
-
Target
78b674a275dac1bf3aee7f83c5bd88c8.html
-
Size
119KB
-
MD5
78b674a275dac1bf3aee7f83c5bd88c8
-
SHA1
ade5f7acb76004c404690236fc808621de70ce68
-
SHA256
efab810bcf40ac398329c3158e0ff8fceef1d0d4acedf22293b6c674564ed9f7
-
SHA512
109b9733d094111e1677bb607b1d467b772db4191324062f6506cc8aa7024ded7167f13c6faacd1c7287aade69879d32c1db830b7642654d636cafbffd1b6e79
-
SSDEEP
1536:ShyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQy:ShyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412474692" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000af76e68ba87318d85673fa68a1f75e10136d7442f363c286ea17488b665c079e000000000e8000000002000020000000aeac78342906d9274913a47786992f75c7e86de3bb836ba190959be85b2e7ac920000000af3958878a33913141dd94c8155ee7de954a558793d064c8488eddfb996dd4074000000084ee5b0140d17202112c722714a7d0692b2329f159ceb9e4722d464f316db0b2e6bc53f812062710c069f78b2c546477ec9489f2b25ca04d11846d3d6894b923 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a6f70fb250da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{359E3311-BCA5-11EE-99C0-56B3956C75C7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000020f1e9fccb1105964beee3170ad3297b6b9e181fdc3f225530c58be91be47354000000000e80000000020000200000007507ff557c8538ee9667aca53971ba01f13276cc0efbccd8c7f9005ea2b80be69000000040636c3af1f9bd09bd3c133dc3638cbbfbd0320bb102aebc702c96e2c571b12a89ff10856a13c7dece19f01478582d5305f9784e0af62b1a7e6eda0c7d01b76f507c7c7dd2fafde4822f528ff905946812528d410dc5b1cc604c3f06e603a380c5edf8613eff84d3a5d61a8d30193e3fdc714204e05379f6c76a133d656f5926b7b2c87cdf0ee2d917249ceac8627cf34000000046078ab99b6d516ce585b7a6ad2cf8c788c49e18989fd6d9ddf672d09f6d1ee481bf305db1e7d796a40bcd2b3eec43891b1581acf34a6ea266159a28a5c207e4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2012 iexplore.exe 2012 iexplore.exe 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE 1932 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1932 2012 iexplore.exe 28 PID 2012 wrote to memory of 1932 2012 iexplore.exe 28 PID 2012 wrote to memory of 1932 2012 iexplore.exe 28 PID 2012 wrote to memory of 1932 2012 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78b674a275dac1bf3aee7f83c5bd88c8.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585a7c942069e6edb052f4445d6347475
SHA1c8fc607e808be0bd5bf5b4299f84eb5f4b582e4a
SHA2565e862569cb5e3216ee71772df01e1a6d6f8a1b29d38de3790f2b2d72bf822e34
SHA51203554e5076f7038f7868087c0787aae27e345da8478d3404d971a8eb6aa1d8e0ba24f540867405a84a881195e2d914c30244fe298fc1645a1a435ae96aec870d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d68284057b8246c3e19dad58a3c5dede
SHA11a7fe01ab6bc284ac987c501cc59c67c4c9ecad8
SHA25640c6d09cc31cf3070705ed40f6112e69a7f1f1934b32ca95357aafda01015f4c
SHA51228d5eb1db28610dac7885d44565af82b798e4ec6b4f3ca6bc986621600b0880bc97d92fbaa932d210468bdd9c122fff20007479415e9576d9e355a4d254032bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c11eadd03f4afcc900c4ce1118f99c41
SHA11f52267d69017091963642ce5dbd41e508120103
SHA256ed090e16a3e1205364439969fdc06458521f76486c94b3ec7c1da1936bb55514
SHA512f6e823fb3309d5d92ee2f2afbd2cc973249de78b6b8b5ec6ff1685127407874717e2a7bb349ef8027bd1f9ff2d299bf7e6e3cfd48416d41dbd5d55f6f19ed6d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba8e1a5b8d07dd1187d5de1dcaa07fcd
SHA1566b36150700d8641c513516accaacdb6fd27450
SHA256320dfd90519b48631953341d60f2da9d72e0600a91c8e904efefb9c5f342dbf9
SHA512366849061256d334df1754be33dffe464a7c633a280b7b7960747fefb31edbe94a030971440f1385dc7fd69dc62c21ad442a2bc3f83ac64f4f6bcd834087de34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3120a3e115fadbf2fef544b883b825a
SHA12134a48e2862c9ed2120b12906bef9d04b889af0
SHA256ec512f5edeb3049df15d6b2f5130233639991bf5b3f7ac764d43422c6d8f0b50
SHA512a1ddf7734993895da27555f88305c5fcac3c144afdfd42bcd63023808a899eb4ac0c8dd7983c0a45ba9aff9d24aebe2d0fce3e75d35e00823b8c59f3bb7f8a12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e5bb261413494edff48303f775a3504
SHA1fceea81d60e86188c95f075fb54d24c73fc9b651
SHA25624cb4e935e8be50dc8e7f02a2ce77a7fb91b4c70d26e6780f828847f39479f21
SHA512e990bb39fc0da78c85d05763763f99a5aa0cc97e0ba259552052f4d6e74692f3de99f77a70afd6d7aabdee007f75b103f11ea97cead5f4f485458599584cd3eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb196d3a6fc19a3efda7b7f12c33dc14
SHA119fd2db7a710af83d7b23378a1a1612f4795d813
SHA256e8fb718626f5e603fa0ce464a86fceb15a24e04e54b0600edd32ef2c236923e3
SHA5123023adf5e4da411b75c3e36e934a509b14060f8cea17f7d2a0e3fb6a8d404c418fa4a97602384a4c122a511adbb584dcd4cd6d32243cc21c8a1e3272a7b75182
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f8d94fec20dd918e446dcbad791dcd4
SHA1b56415c77bf8c255e9367693424231791f2e4461
SHA256f606d000b5746f5a86b3d4bf37d5c0a0471b158d59803d9c25c8b8f28d52143e
SHA512cb468350e9e61a9aa3199cbde8da9eabaedf64624057bedfc83ba5834caf070dd001573f89041059a0cd5c65c4cc4a97e5084690970e11eb6f705c32818b81f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3d37dfefca30ceb489e0fd94bc740c8
SHA1a63aa8d4a8391e2a39871d524316016e49af5ef5
SHA25643d3ee67c3d211c9aff65b7f50c422680495001ca28a5d6f192251901b45c529
SHA5124bb18fec74e7592b87cb49257e0b012a3e16a46ec751abac512923408d01f50a6503449bfda341ad5b5e8475984cfae48d6d5a5b4475f61b28c9c4298b78c010
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55924f3fb51abde32bff0171800426ff5
SHA13ded6a15274ceaac3debea29fd11d8d7243917b7
SHA25642f66f968306857036a0a2cfb390fcbf2c2ba796e946675c3466d3f75ac63fb7
SHA512982d3b2b49a4c9849755436187d7dcad9cf9aa8b4be6ca9e3a07bff9d839c636c0a86acc2b94e34b02d71373a266e9ae82c75ce74185fa32135ae6b8d9c1724e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565540b5ec9bcb84b570024927feed133
SHA14790a85e1ba9317a2ae7e6afcdc12a72eb7a651c
SHA256a86b537d6b43970f116ba3643351d3e6a442df439c3f4cb96c0335e4adc6c51f
SHA5126eebe169ade38bd96bd752e0419b5a3932db1d973cf9b1cc1f5a1a8828204715e20b59267a15dcc137e46d5ecf5a1bb2bbcebc8567db7d55b0536ee756af68c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fb473e012a27922b53a27fa11aed515
SHA1e508eeb6ce7de40f519ae425097716c8c76eb654
SHA256498fc2b9c26bb6c9a86c5045a93a2b119711822d6aba68df805e0a5e95653850
SHA5125f88732df48ce489e13fb25d15b7979396c2e407a29c80347fc1a001dbdeb9f2632478b839d6c51a5f65f196f74f540c07ce4410b7000e1f6a7fb0dd9d6bd0b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9482633d18f1d14e2a9976058883bc6
SHA122991cb64c7bdbf8315a3306f93a8f227549618d
SHA256b1f048498992d657bd054ea0e4ba4ec73e02d80525f60845586afb34c63e105c
SHA512e660178d2dc4087634f826cb8a3cf70dd12b3c302ea8968ef7c412c9f1a24b3962b51e5428b74fcb2900b1723660fa5c679c99073c28e7f03df8eb46729d36f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df07c1c2444cac09fe8fd213ee4798bd
SHA18b4b827fd190f4d1a5dc7080fe7d3a5b96f22dd8
SHA2569cf5de8eeb43e0c27349d3dd565cf2560b49fa928287639f71a4fed7ce34c5c2
SHA5124701760d5ed16f39abf3d254ac9a04141dc2727bbc553fd36acb3f50fb73e895dc04ee6b738b736faf8f8d745e92877ed89c7c57169e4b7ecae38e22eb7432ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a84c8713ecd6328608df5eea8312d74e
SHA1df608ed17184bfa6d581871fa4471f856512e121
SHA256aeb8feb861cb14e6209873b5653fcec44f4d1ec1837c236874bdb16a6c2a3979
SHA5120b84f8fc255cb65e89b70f876dd6df10009289c2e707172f8a9ecbd8bda11694cf90765b20ca8ef30bf9e1a3c8f001ba316bf13afc18c0e68f6b566fbc0ad72d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d010b7aae1341731f9298e82c69ece17
SHA1650bde830c514b724260ba361a58b8ef5ba585c2
SHA256b31462c4e7151d70c363fa5ed91b7be06850d4577cc1c64f579f8bcb90ca2f60
SHA5123cb7dcc58674d3dd21b7137cd008218f0c3f2f5477fd48641fc6091fb34ba98de9187b369d6d3056f7839b5d9570b89ff993e049fe7b6c4438e49cfe446edc75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b76863c854ed5e8e463f33cabbb9c69
SHA13205c33ec4425670507b77135b99633ab3054586
SHA25643f9b9f5c283f02b5fbafe95c042419ecc8a8ef665284504c2dd247f7a1107b5
SHA5127b9ee0d3eb28616023178ebe9295874c33e1f61f6e7522c2bad0d0b7b9ac8cb6b01edea831b73482ad516617e847ad261360dd01c2b520c26a9e36462510a622
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55285a73d63f0b3edddb6e49df3897480
SHA14227ff0201ee44e932e8650059f98b2b27546f48
SHA25696d40036a5f25a252d31937ca6857b8322e1f58495ff2357efbb3081a668fefb
SHA512e9074d34377f532020330813400dffb727128456180743b874779b54aececdff736efe2b9bafdd440233c4f821202b70830cfefddb329e322231e545f5d69992
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b6d75f46cbf876653fda5f3eff26911
SHA1a5c5bc966bd712fdaf3c4d359d544e89ff2eb9ad
SHA256520213d3d2c6b8e1257306ae82eae83b42c90d3949c7fa0805961dad0caf3b78
SHA5123c13a4ffdc0e0242a1134cc4b2613eaff3f19c0d404d1aa68c3b058607510bb307f37739a3fed2fd2b9db1efe889cb9fb36c5dbd246d3ce357edec15e7550b99
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06