Analysis
-
max time kernel
120s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28-01-2024 23:35
Static task
static1
Behavioral task
behavioral1
Sample
7e4c8519e621ed09f877c3534eea6a74.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7e4c8519e621ed09f877c3534eea6a74.html
Resource
win10v2004-20231215-en
General
-
Target
7e4c8519e621ed09f877c3534eea6a74.html
-
Size
9KB
-
MD5
7e4c8519e621ed09f877c3534eea6a74
-
SHA1
26088df4c0cc4f1fc11a9de1b58ce6fd1970c9e1
-
SHA256
dbf5a6f9324baedb7da9efc91d134eb8acc3673649ea1d460990ba7f51f7325f
-
SHA512
a12e9d1ae4993097a7a6af16b9d770128c84939b88388df45ce9b2dda58a5faec6c51aef2b44f0671b04c0bd923c49d6742805495aafeb363a62e23fa2cf117b
-
SSDEEP
96:uzVs+ux7cMfLLY1k9o84d12ef7CSTU3GT/kPsQOpUlVHcEZ7ru7f:csz7cMfAYS/G1UUPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000006d51658df2ac98afaebe5ff36771bd3844ce457a46d42674f91c03e35b1bebdc000000000e800000000200002000000050a4b7f4369deadfa898dc7217d84e68fa9b942116b0bba10d19f27519bc587520000000ce040d800ca13246c9793be2a49e46e1e310868ff1171edb1ffa4169b8bc09aa40000000c313fe51126f558531a1683ceca99bbd2ee5fa82a9af45c173cf353b3c9caf6fe4a9688aa9086c25c74785edc4c7820acd84aabb6a341ace11b791ea11003ebb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b659c94252da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412646811" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F40524D1-BE35-11EE-B0A9-E6629DF8543F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000003b253aa3f20a543ecedfac0f7bef750c5130045f8bb6482b639da66f9fb3a503000000000e8000000002000020000000b3bbfb18de1d76cf25909e7bf3258b24aeef0f85648bad23906356b45809902490000000e9eebdc69b25cbd5c37747eaea653fca9c48eb9214f230b7ef6e07c79f9334377fe8bd6113e6f6aae56fe2f214a2f8913b66e930cc903b58f648b1e9920399e36b745f1e2f38a8e47dcf0bf774a7c82ccfc69d462e5007cb896e49dee3c289d42a43a022f8847542d99f25a36329000ba39f5fd951d567d2d307b6a533f6cab740180ae484025db267ac411e1ec97aaf40000000cf0ea9a40f303b3b4fe0d778794b9caf4a5f704acdcf8509e5d8165ef622f35dd577eec2b6c4a150ec10cc24ece57f9698d8643f139e86b7740a8e5e4caf9e76 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3016 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3016 iexplore.exe 3016 iexplore.exe 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2720 3016 iexplore.exe 25 PID 3016 wrote to memory of 2720 3016 iexplore.exe 25 PID 3016 wrote to memory of 2720 3016 iexplore.exe 25 PID 3016 wrote to memory of 2720 3016 iexplore.exe 25
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e4c8519e621ed09f877c3534eea6a74.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c90127ff7b8f1ac7ccf88f08adaf6aa
SHA14c9d444765a3d4282d5e46ae788f457ae1e3eb6b
SHA256febd888c540cab155f2508f3e1e2ad2c99fbcbb7da905ba74de40bc603daf60e
SHA5120380d59c598c95e7c5760dc34279b2884a18bfab81b0729c81f3edf76b367192a37079ea045b43cbf77356c37898b03033ae92883bfb418ac412b1fbc60fc0a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583147c7bb60eee5bc80e7857b343a509
SHA15a756e83a43307d409c734224725528da4b3446b
SHA256cc948bd1fecf618fae458f99ce0bb33e34bc49c08dbd0db2657881692392a863
SHA51225f30ffa8475d28aedc20530eef3e8df857fe463c193f0b6338b6588e7b4265685f2c638303458c521a095a91dab3b4f45af5492fe30736c8bc4f94c89a225e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cc26dfce8fefc4a5768498e1ad37ed6
SHA1acbeedae7dde183acd77c81188b32204b772ae51
SHA25668ae87e1b749cc5d749498db5c40de19d028fbf463ae35b6267a247c33a82533
SHA512a6183b7f1d8a95250a6a96bc634db8cc1398794df0aa6556e6e76c25722fbc18e3f04a628952409dce6a00a88f345f523926c057ed78c1ad7c2b15d2a2999681
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c26434c156643cffb721b6bcb071352c
SHA12ddd97a2979ede737ff566debe9fddc6b07d4e5e
SHA256cea3761193275703412e36bdfb4c75f3f39d623c92341add1c8a35b5d53c8052
SHA512f20ff82cefe816b6766cb71b3027514d0597dc4ee5605b7d5aa926d1c682dae1a5d084974cee2c5911788f8c065242c3c3f1174c81ee5e29a0d6359bf2b3aed9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50669d5e7557b7639d51ad7b8551dd9f8
SHA144a1b9e5ef650118a0ebf64680e16ca369d917a3
SHA2560b92f99315a27606f3a53ab7e2096b8b3b70f232421139a12a48275372b07d56
SHA51216f16b53c759de03c92cf39cc60a3f51b9eb49143cdd2a0526aaf84affb627dc18ac645a7cb024bd0f0797d9ed0a5268a0e40f2b1386417a4f45a228d5ecf416
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3064840ca135d307986e527c65f740a
SHA10b994981d619d532d8f299593f1593da98b29a34
SHA256b2a951ecde9b1c569d4aa475539eb1daef0e91a7ba31dd320f3511e99680b530
SHA512b791fba598d7ab266567a87b9be3ea2eb344418865de30bf12aa482a19713515263f7b947151f615c3a2b76bf17066bd1b889fbb6fdd59b49502f0229dde8be8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5866b6149e14f69c8e34e644bc48b3f3e
SHA1f0203c7824a44f35ba7bbe7d8ff8f9d57b7107d1
SHA2561517648b03295cd2537b855f075b07b9696e16c3e7b5387789732e56ec58ef65
SHA5129058db1ec7bbd75bff66b9abb7e365b4eb81ce0df61dc4f7448e2f2f8cc089cf1c3ccee72eb3a840369d175d5f2ee64b1a0903327d64628f78eab74045a5fbbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544e9ebca703ba190bdfb64e3a7d176b5
SHA1264f44be3fefe8c8342f720c40f37d1ef1e19f42
SHA256ab4d684ee662cac42796dce8cfc47037987e6530d4329270f04ece073a73b15d
SHA512c113fdacaf1d09a46026e4bad615a34cf0be1c37271ad1fb90e88a318cf4edf0bb4229945724ed662e0715e2f9907464031e9178b66e736700eafa77d8f8a3bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df7366face74da8eee9d8befb8bb067f
SHA14dfd55c8d29f377251cea45de9e83aa9890fbf56
SHA256d057f1dd8886beca01f5c9a0e64b480d5ce5bd7aee821ceb16e85615fcdbb885
SHA5125776ee618888e84b6a0364cc475d021577ffd1405fc483dcf606d641ec1fcb23d6e70695de63117bb845b8ed6e5ea87c6e343ee0c15aff62b13438c02acaa878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfc61a2fb1ff85f58015109031d562cc
SHA1473ca9331747a2db9d28c365d3f1bbbee45f1f93
SHA256bbd0ad0eb9f9641c6cb7c1c828ed7b76a89ffde145eed9c2658990466c15b345
SHA51255ae2ef42528c920a1d762c9b9da61e84e8642b1bb32fd63c7c4bd1b412dc7adff624dca9a7c6f02b369ed08cde3a0d53c209fbb0db7295d1e2a6a4af1c180ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c4e45bd5505389d4e9fc57ada2c4073
SHA1f7d74a80800c9237b802da031141183d36b5214b
SHA256066bdbb5cfbf91f0e13be9a61ecc60ecf3784caae51459dd61449d30025fcff3
SHA5122f16fbbeef461c7cf6e9745c653cb57d8fab84c3a86defbd23041ba68122da3cf3ba9fd6404b17fdc99cd9508d7a9af8cd22114d1362689aae6a38985881b669
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589498d3a8978e3872c07f03161a9c4ef
SHA1e2c5c65fbaef1c422f4c225dbceab33fad75a7ff
SHA2560b58023fa10c3cd8e1db46f880b39dce831a7da04b516c0b7bc3bf8b5e7773d9
SHA51295f51d6aa49b80e64da5daa2d0c610607d87ccf63226abaf816ff5941e37b6d45c8ffe92f52fc1a794b794859eae773bff40f75e68534f98cff15a7df7581915
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1d761d34a72baae9021c79edf78da51
SHA18cf366de5779699e7b01a9837931770c293062ef
SHA256b399e1421e52c5ded582769b2d454ea7e38e29ea5e3e996540bf3bef08dfee39
SHA512a7649d220cd696d43b6502ab20a2e02a05c83e91f4b6d6756bd2df8379adeeac0d1b201847608850e0f48175c77ab4a34b4f39df6b42aecd02e2f6353778269d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6c7f90bc89c86a2b5214c128d47a3ed
SHA151e16b0672cbc727797f984be8cd5643521d7dab
SHA2567fda5721dbb2d4b35f670f5a44eb8c687d955235e7108b1ee558055d22f1439b
SHA512bcc63e5d98d782d464d6fb10cad002864cb61babaee6bab76f03874b0541646cc2657b83fdfa3aa7dc71c9273a809992d5bba9a3447a8744f3d050d3921bd9c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb2228f1ee04feddc3fabf7472c6493d
SHA1c840a5d8f44c83453c55d0f04af2f74464940e30
SHA25624cba42f024b00844ad1d6c99122839577f490309ce4f67b0d62268039fb4f56
SHA512764e82302d5f656687cc11efec9bec857f7a3a50d260efe60bb1e2f8ae16f73721e3c2c9f9ea622547cb546519341d61f1f13b801e72d51710bc0f7f4c184d11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57077c9e992e6f0fb5e3b250970fd7d06
SHA15a3e73745853813032b39b48fc01d5881aec81b4
SHA25644a4846b577ab86f9bf43b14c83185b1eff2d50685f3fd752f68d451d810659d
SHA512cc6bca4e60da34c0aebdda68301bb94dbc20db335a1b33d00fb0535803c5ce3e0830e9f064e260ec899bb2497c35e6cdbacef748be26719b0e212ba80ba96e4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9bbc60d0b9d94db26b887045947499b
SHA1c6bdce01ebefc1df03e2e43eea1c8644a817fae1
SHA256152bcb5e30fa913d6486165f39289b1ef484d2072e19c7d8e2eea3948e1e9293
SHA512fe3eef88221b76647c571b1b5b86c3be43eb7882e86b82182da9c555bb45f4e41aeba707aa59e0c38c18e07849b93c26170e3d5fe47794941026348cf73c7eb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592e5d6b49590e64b75ded4974a1cc7d5
SHA13d3a3b6d8db6beadb7756602fa7c3a48c7cf8da4
SHA2560aa7d2a206b5c750a4440cfc905a1bab015585d636f39b9320a8aef97fe5c469
SHA512132784e0427d9987cd0a1dc87f6c79aea4ea9ec817de6b6c28e7079a960de2a4f98d6d8772401e7091cae45b6661be58e87e61b58dc33553ba49f8440a68872b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52720aa7976ef92b63d9b21b4de62b07c
SHA14057b55ab70714c0af30609e9366d9ced5a6102d
SHA256d7aa847db2ffda8c2aedf90f0bcc31cbd2fb0c3dddd8704940e597650c21b7af
SHA5128e2ee8eb4434a19cf839b71e35457f2396dcf8764e226f0076f89ab96027e5a039221080d1502ac7adbe02c9ac223cdf8cdbc2d2deba0ad960fcf6dbaa73356b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06