Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 04:33
Static task
static1
Behavioral task
behavioral1
Sample
7664af860535c0b95a608fb275dabf44.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7664af860535c0b95a608fb275dabf44.html
Resource
win10v2004-20231215-en
General
-
Target
7664af860535c0b95a608fb275dabf44.html
-
Size
432B
-
MD5
7664af860535c0b95a608fb275dabf44
-
SHA1
d615ad309b21d8b25ccd5cd8dc6aeb8ebbc099ee
-
SHA256
7dbff87eb2f065c9696deaf7566c98dd85475196d097a2f6f36ed30706d27956
-
SHA512
d7b8ce08da2edd8bb9795a7bfef452660d3c9acce863cbc8ab91640c2e8251d6a99bf931a02892a1bed522381d5b1df29b776f88514179c3401d2f3e31864992
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305277c91050da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3620545786" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413008567" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\Total = "118" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3633827930" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 204a63c81050da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ed60d6ae529e0e4187beee4fa1d8750f0000000002000000000010660000000100002000000033e9dd9aa5953d95a5c8f045b1ac8d78f8a312b4475973e8750e7a38415b0bee000000000e80000000020000200000006fb756ad8b19fe651cbb313dd68f1ef13a813367d25da5b92a0c5094bef32c1e20000000983681606d45747f7dc409cf3841827aab50609deb1a9ac6d88a92c0dd38a2cc40000000473fd71e86e54f2d84173fd90780719c4e56309f31b8d4070e97b991a1bacdda4dc49a70f2123a76524feb0bf279eee4f6d35784aae0fb20d77cd270b3e66d9a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.opera.com\ = "79" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\Total = "79" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "158" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31084560" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b4f6cc1050da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\DOMStorage\opera.com IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ed60d6ae529e0e4187beee4fa1d8750f0000000002000000000010660000000100002000000039a355dbcf4eaa6f4803af36b45a59b7d2507c7a2c1dbc6744df25548134c2fc000000000e80000000020000200000001c5e34622300f2d186166e67b5345e596a485478a184462164d214aa7effebab200000007cd6894825a3e29814da2621dd33ed3af1ffe57e43134f86f6ad218f98bf324840000000711a7582a7073630ac7402edc8179bb148437405481c43d65f469989d69fd76cb05dc2524c358cdd34e974deefd5e3cfeda9f8dc2be70256fd2b97e86495779d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\Total = "158" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ed60d6ae529e0e4187beee4fa1d8750f0000000002000000000010660000000100002000000099071c9336673688449eb40c6bcd14944dbb1c3847a5392e805671c41a170ca9000000000e8000000002000020000000194ec5e0d0a5e5f76c5f6d2b20e6911f12f51dc3d1772a6a2696ad9948a849fb20000000302701a2eab51b12bab5b6cfcdbb7d2dcba70ff0ef30012879b44e4e98ee5c8f40000000918a002eb4c63e398b3dfb26e3c83dcf67982f41ab9ead88ba87ccc5803a0add2acb379a9534be3099f5ec612b8116384e3a9ed10dcf92996b739f1e5c986b86 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00bfac81050da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.opera.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084560" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.opera.com\ = "39" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\Total = "39" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "79" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3620545786" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "118" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.opera.com\ = "118" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ed60d6ae529e0e4187beee4fa1d8750f000000000200000000001066000000010000200000000aaf34b11994a70a08f9e811b11858e2095c792c5375ba61898c6018d6095c86000000000e80000000020000200000003e8bc59a13e29b1c72582b58f715c3dc6ab5cc2aa5936aaf3ab46aec96ded3d02000000088ac3d058f39adef590ff965288fcc4c06b5cd8129d2e92c341d11fc9b5b91254000000094449adc47c13a2a5e5bdbc07d5f6f399cd0e7f343a619f3cafd733dea1179bb78ba15170ed0572fd062d76f51c89762932b162d8f28b2257f93b5712df1babe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084560" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{035F6A01-BC04-11EE-8024-FAD2FAC7202F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "39" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.opera.com\ = "158" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4000 iexplore.exe 4000 iexplore.exe 4904 IEXPLORE.EXE 4904 IEXPLORE.EXE 4904 IEXPLORE.EXE 4904 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4000 wrote to memory of 4904 4000 iexplore.exe 85 PID 4000 wrote to memory of 4904 4000 iexplore.exe 85 PID 4000 wrote to memory of 4904 4000 iexplore.exe 85
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7664af860535c0b95a608fb275dabf44.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4000 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD51d7f25dc2d6699e79619c31ff8908f6c
SHA1de3c1be6c3f3e7f6eadbe715ae575794e5bf1221
SHA256845c8a47772a9c534cf13a177c83c40db250a6dbbd0a369401ea884b8d058d6e
SHA5127a6e1765a31821e79b766ea0675ed17d735a40766d5fcd6cc305a8d33b8257d11e492d4ad8626f2909e1c2c2d93e8d04ed133effd0a3ec29324ec3ca36a22a1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Filesize471B
MD5a098e33eed71e506e68638142d154f8a
SHA17312aa178459fd3c6bf37db84d595ca4f083664d
SHA2569ba37721167b40d5a3acaa6ef292822b8eedf7f0902b6f3bcb59a649e5339b13
SHA5121ac972fdb3ca9322c05a450fa6fbe9eea6fd2c3f2adcb34a3eaf0a4840a2bee3f16efb30740e96221c0b669ea3653e9aa453e624190309f4b32993522dfccf5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5d71811f96461eb8325f3194369dc306b
SHA135e1fb40b4e70fb200be4db88ae9fb0eace49063
SHA2569390be1700dd56acd77e6e6a2aa857fc3c4ac74ed5b36b9cb034d8738cb0f318
SHA512b128455480a41be51aa232938a111460413b2fbb849eb6ab6686592e6e8f0110a77a04650cd0831748df2569e7aef21f4134423fe7ad4566e79db500c2a38401
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Filesize412B
MD5aa603ae35caec071ec471e23e86b8509
SHA13663547cd071afe57141bb0f9fe3d9835bc4f2d3
SHA256aaeccd5728d64e22132a2e2445845d156a99479b7660cebcbe08a2f60cfeab6c
SHA5120e7f67d8c144160dce3c59f74dd702024a58e889797a205b5ac3a9848278b001fc26ffb16655f5a7eed5a14f9954f21cc080e7462019879d4025b6f2dfdf27a2
-
Filesize
6KB
MD57626268370eb85b975faf9d224583999
SHA13aee6904ffc3bde6d04f2d60854567d8fe9fc82a
SHA256bb67167dc88c31f2f661844553f32f61726a43a70dca06112e2ba300344caf83
SHA51212ab72265586bc0608069cb3c078492d3be1142b27660bfd2122065fd3d51551d0519fbdb766da477a3e762ce04fb474669c3af44829ce7f23c8eee043f04d7c
-
Filesize
1KB
MD56094c7ac6fc99440e73e941faa84b14c
SHA1f5eb8612de10faffac72d9eb79803c93b3d201da
SHA256393c29c88f4b9c43e2e398a434d8e5976e9f8804e6c53c613bc72aecbe7cd390
SHA512446fccdb6128d7fc49e277676849d6039d6c3aa54b6aa938d8f8bf141dbef171a3164bc9a8f00f29c8dd90615669baa221027b5ac10d6ef548aa0bb380d74329
-
Filesize
1KB
MD591abe01116ab422c598e9c8af72cf4da
SHA10f2815fe8e067d48537ad168225ab4674271fa27
SHA256b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
SHA512a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c
-
Filesize
5KB
MD594e3b24366e3faaceae2583c84668c09
SHA1ea70800d14a0d3c15fc98ac0c4b1568226d637d8
SHA25607e8d69985547e670f5752809928fb887516ddd67e56d24c1323b4abc88723b3
SHA5125bb08351d4e875d929aaf216af2a9a39277fdb455d7ecef7f3a68bdcd4de977ce782e59ca85a4f5406fc68b30b4c879bc949bc44ab271b61ea75c70ccf6838d6
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee