Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 23:51
Static task
static1
Behavioral task
behavioral1
Sample
7e54b35bac03a90288733501ba481d25.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7e54b35bac03a90288733501ba481d25.html
Resource
win10v2004-20231215-en
General
-
Target
7e54b35bac03a90288733501ba481d25.html
-
Size
7KB
-
MD5
7e54b35bac03a90288733501ba481d25
-
SHA1
690eb524063465348e1d06188d88f9efc6904552
-
SHA256
a20cfa0910f57675a7aacf0f084d8850f1f5695fed269e0dc27ae83155a0e2b5
-
SHA512
c5359f7722867796d90ec6269cea24c993b3492e88cc7e389240b02080bd0854abf6d77a38bdf00028a9748f7c5c7a000d492698a71b6bd183fe8514ba6dbfbc
-
SSDEEP
192:R3hJITEu6u16K1z41WsryDxJxv1c8UKFnLxWzfkR8:R3hJITEu1131z41dIxJxtc8LFUbz
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000e8cbf68ea54ae3a51de257124cd9259e5448d3875ac16c6d09445da145b7457a000000000e800000000200002000000091ca0c6582196ae054ee8e723d31426614dc09a73fc1c22378d942b5bf7502c290000000a2ba99dc6859440b72bf6f896ab9cb9b403a69f72bdd45576f44399c671a11011c9012ae49ae740c3b543ef2e031e5c509dbac8cefe45df1c09ca5a6b93cb4b1847932f0d7107ee486e6b47adb399d3ad5a0097c2d3e93b1cd6375cbb9aa29d8b1bd3f1b0df35544b26c37fe63bad41036ac64d1f1917902f57a962d8f663d58108b2d6bef9d2093a12bff6ab2294663400000008c111770e15fb2d131c19a57139d96c2e9e0187f13be4af034779f890a3541a1e13b780e015ddcd2179a5d64e8d9c833c4d90e32c0ee5d323f65033f60f33d36 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412647773" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000033e81628f04456ebbec20ac6fe9341933f1e3007df2312bee3533f83332a4d08000000000e8000000002000020000000937e037e7d19335aedb24ae75e293bacbf118e7cf865b58cd94cdadff5c968af20000000791e4cc06c88d035972a623122bbb1bde4aaa2889cb38d39c373472c5286870640000000559771c48e61187fa89f411121a449e032531b3b4eee2d8304535a1a627a633b2c239484610b61d0332dd5eb49307d185b9da12fd8dc15cfb73593dea3bdb2af iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ff3d094552da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3219D5C1-BE38-11EE-AF58-6A1079A24C90} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2324 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2324 iexplore.exe 2324 iexplore.exe 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE 2332 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2332 2324 iexplore.exe 28 PID 2324 wrote to memory of 2332 2324 iexplore.exe 28 PID 2324 wrote to memory of 2332 2324 iexplore.exe 28 PID 2324 wrote to memory of 2332 2324 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7e54b35bac03a90288733501ba481d25.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bcd5e556b1dcb3d5d9575e3e467481d
SHA1736c06b5a40f553aea0f3790259807bda45760ad
SHA25677618788ba9aa6546caa1e30031d11267dbad9b94f966216c11d783f69a8633c
SHA512d85b1ed04dd9cc17ff3968bbc2ad0b438052e7df59f9887b6999345e30fc838651fc9dd562d000c1d470e6a1625d5a8b495c0610aa32f8e456e49f994a1a4e32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b587b6f470ae47b2eaef99ad1ec56adb
SHA167a0344dd458678de3cf58415fb7916104a0574c
SHA256c53473fad3ca026b4d45dd85e2a29fba4ea3e40d3f5ccf81bfc3901601b985d4
SHA5124c2912243e741f5dbc7aee8b8a2e38d8bee1d1feb669c704cbd843aa7af89c7621e7d0406f855c90ea70e036b79d82525881fb4c7bc75ab7c1dbc5a77b2aa8ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555b7f32fe94005d78ea7d12293cd7d71
SHA129c8ce0e94635b71b3ab55410ade373cb53cb3ee
SHA25687de0987728023bcfc7a0306a497cc3a67da74727088f38b1e2d3ef10b8d7df9
SHA512c7e6c550b1f8402815677464b24d2297acc4305adcee32ad62d9f2f3f8e4ad6b45e1815134c3ca51dc0518cdabc6d3a619d1e151858f05794ab4bfe9551c3242
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fb7915aa0fd5d84fb4510c6c5de5ca9
SHA15861950f2ac0bbf52f10d3092f9549f44091e310
SHA25644ee331a9f163f1d0c4388da97575c670850a4f89c720bb6c1701b0254fd46d6
SHA512d6fa12ec55a00837b2df7141c043bbaf317304cfd8266dd5ad99046495a3e6555eba75cde202fdb3c0a6965affe8f75c823f582824d907749a1d4381f2bafc2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598dab9c573c5c2bc94a3405d09f3fe84
SHA1d10bac66859598c38ddcb369a8bc305bcd40415f
SHA256212464ea072160aaae998981bed85e1e0f6ea97ffe3d8cf7461dd0a0927bad8a
SHA5124bfd08a7926624c8f9075c65f832026103b047f21353a98d4ad301a7e5806d31b45af67b4f5ec47929904d8dff8bdb759ae534dc0a967c09580de48269cf6d75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585dc9d80465119d05997bd27f95197b9
SHA1cd0589c4a0fa1f4a6c01e924d3dadba36105ada8
SHA256d87bc24ca861a2995f4a9ebceeaee5c0cafdf061ca2abeacf56b9d27eac92391
SHA512480b778c542349da45521499376aae6b394614cda5f3128cc9d01e56fd8391e17e2a8a8d7b26e134c41d658df4066448ad60cc383f6a045d65f47ac98c8fd497
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbedb6bd9e9fd3332b91189a011bb98e
SHA1f8d6f1ff1dca1d78f77a50196b01d87e6208c6c9
SHA2567defafd1541ac8035d52e2a9f923555abbc87cd0baed4f418c6ce04528f3c944
SHA512ba5b66e20fe11c064823739e3bd42ef49ff2647bda20ac96a76d96df843e815996a2d04595a515f6ead71b45883bb50a449be86a46e327602fed1cc37e09ba56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fc4b4c6d2d5dad1539c545db285e8ce
SHA19c03820ba42028549fddb8ec595eb9bb1eaef997
SHA256cd6a79ed5cad98d5f674b2b33b5a9117af7495ff0e1e093930e572db3cb6b16a
SHA5126af6bb3abbbb30538f0361b6f9d17f726692f4909e5ac83c47a805f79e78505bfb8d43b21e2209f82336d07d9b72a3c4d597e9a77b6007878038fcbbde3a7151
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d84561cd5c62abfd8da0521c9009e8ec
SHA19916b9d585ac2dd49a76750d0bbcd6a7574e95e7
SHA256f16a8129d6bd1d5d3237fba3d0fb60d7374e6e2cb9b828d23e160cc536b1f5ec
SHA512813e958f995fa468c5a3c598192aca19c7fcd7ae78170b49f3513e8bd9c303d7c14b2de048b157e9355f14933ca8d589e3c1d8a853d1e82290845819e67e3f46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f91ffe299aef0c4b9aee03b13dd14fd
SHA1cfd649ba76ff9c40d600fff1893cb0fd91fcd34a
SHA2561468305b8cab7a2de62ec17ea7cb5cde4edc0a971f7f213ef665d2a6fa99238d
SHA51212a93fff1e005cf96136e8ca90153062455760f9285944aab4a1035b6de7cba04c310554fb576031c363363e24627b254915bf7addba1785a257dbf9bdb6e72c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd62055593824fe71bcb2070eb2ed71f
SHA1d3cf8f1720bfd675480cee5ade31e2a5024131f2
SHA256a8f1db276b51c1dc8091ed433a4454edfa33b3e1a6a56d8982aef1fca72e5e40
SHA5120bcae32c86f1e87ef7831dbb368685d98c4ea2e8c2bd2e105f6faccb447ad88b12b11cb8131ab5d020c9a03dd7faaabc9b7330369b6b99cd97ef32c550ad9d2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e2279cdd6f15180ea65e5030b3e9628
SHA12dd9881587479198835fcc2c7364a7cb6e2afc6d
SHA25694ac58f3f7be69c0b95c072ec624ec0d2338e641beebdca37d2792ac23f1758e
SHA512653c656739d3d3a1ef37d8d0ccd74841886d37d5ee55f2fd00c8be1d5b6b0a5e787a8ba246d4e503d04f2b994344c37d1619e3b32af645eb1c70b32f2824d82d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd5d7194738c6f3515ae4c2e5271021a
SHA141a5254aaf085b01e17a5df3714a48e56682f68e
SHA25699e4f431fa24f3ce224f7f624ca9144cc9c7a43f23d55af6aea373c1d6fb6011
SHA51241e554234aa1540c072c2a8812b2ac2195ba3262383ea63eb5b0bcdcc91cc4d82e238d590ff91495b29ee497de92993748dd985ceba73816c456387dafb4b59e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f2ca288a00de15465cd2a835b20601d
SHA132f4d3edad66ded7f4a8eaea36d31e0f7c2387c3
SHA256753fd2cc1188242a9e45f93aca4f0deb59df452b529f47b4755333e0e6745173
SHA512d09d592e05c0e04cb64f5052810e9ee3112fccb982653b4ef64e7ad21c09d12053932bea840d86a967d305c1aae864d4de23a53ce0c1a5d210c1a428e94f6ff2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdfd11d176d4c6011a2ca367ce63a3fc
SHA174a1b074d5c247b2e467c4e092abfc2f06664894
SHA256c5c441490a232e749a03c32ceb638514827ef9d432afba4c99356408f77ced9b
SHA512a1e0b7c1812d2bb33d64da1edba271be78239ea8d1aa023d1271a4180f98e41504a44c1239ff011769e0b2acf3d7b34a7185685ea84cabf2b636009ad25f6ce4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3888dfa7260a1ae1dea4bcbde25b59a
SHA1375da4dcc0ccff93336d0a8bc3700ae905d41eed
SHA256b4e298af19fba7c364309d1e6caf7c319cd70cfe06617c4fa27afee71259cf5b
SHA5120c5c1026c25563e6caccec12f0206207aac6e60001a0a5110eb93b281705e517248a85d97893e1a961ea7a785c1e43fc64d49ab316423b9d934d9cc01211d208
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a5dcd3bc31414d20088a06a6426459b
SHA1fae3ab81ac3d8c2473baa295b3a55e6cb65a8907
SHA2566b8191fe129494bb59386a097deb69283d0efed2735eec13df321185cdfaf6d3
SHA5129b030711e625073c6330e28bfdbb6379c00d629a7d18fbe7efccd675cc1c7c8c90ab522094d421095f9fbb0efcbc73b91f0316ac24802d6827f2c2cba268b04d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c36fd96969715025cd7f42520f1497e
SHA11aca871b6c2f132ee2fb432bf2d10fa9f33c47f9
SHA2562dcacd39168dbcbea4be6e68628573b504e5be9f08ffd5c66ab52ff49de9a265
SHA512fd11bc6e7dd926d993822c6dc5db598e75fa2dfeb82e6426e7131465f6153906b158c2f08605fa20aabc0a0e91846f63f44ba489928dc94608ae0398f5d40c60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d120bbbafce9bee774a6f16f199bf3f
SHA15d61176ac7a023362dff173ba5cd179d6352c3fc
SHA256993393c55553159133cbb717e9c67221bdfa0165a8af2a9d124f2824e8b7925b
SHA512045a7d9db4809d5b4eca3063dbe223112ea876712a530843e12c801a62da395f582c9882955894e729a9af30c8424dbcd8d3dd101d19ef9f51c2576ba35818fa
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06