Analysis
-
max time kernel
139s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
7bf0b4514cd8d4c25bc0e107dc17468c.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7bf0b4514cd8d4c25bc0e107dc17468c.html
Resource
win10v2004-20231222-en
General
-
Target
7bf0b4514cd8d4c25bc0e107dc17468c.html
-
Size
29KB
-
MD5
7bf0b4514cd8d4c25bc0e107dc17468c
-
SHA1
ae26cda3e8a2338b2b57da862a91b9368e6f3f9d
-
SHA256
d2df5a90db6df02194589e28222b08259915c15e30c36bb61cc4fb238dcb8243
-
SHA512
a6ca6db963899b24d723b7d59dbbd7d39093f0022e98fce7d2d6e9ada075a7180afdabbb48d2413f95c794883ab5d4e9269619299e6a6b0334cd07ec8a949f63
-
SSDEEP
768:9niPihQ86le9hQRUFFlsrdDw6shU/4lKkVGdS6qgKUW6WhF:9nskbVz7R
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10bc10119451da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000007d5e478a89ef0911605a3c578cdf995aadecb9c7a7db7117c34a48622c69a5bf000000000e8000000002000020000000fc7d3a6877b9d50b920d36ea25fc07d246a1fd1d060960ddd08489703e20e00290000000378b631c1d1e97c1a18d1f9e3d2f791a58661bd4ea2f8bed38aa1a8159c2665cbfde6e8470d67c941380e1ca4d4c474927b03a6fbebae0b6b24409af15ac1dd88ae28f9c0e70c740272ced193d8265d406c0fea7a99ff62a06e84752c4f08852a17323d1087579059db174e66f34be006e1fadb9cef318370bc77f1b0d4a8205a36a25793746e541687df5f277c66f084000000090ad57e2a2971198ca825028a396a6f241b293920c8103a3497391b1748089bba6d44853f1473ae361c6d12560cdbaec7423d23571e1bf8e0ddd139798ba6712 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412571752" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000046a1facf8aacd6ead04a0ceb1adde833699c8a7da3137457e792ee1751d29d70000000000e8000000002000020000000d38bc3ee5f2a06a1ee79de071c1c77f87f82cb25d6dc05f9e0b3b13f4c4f395f20000000a1df3a6f099593553434ee2f66cf16c572cc1dc2011551b48af85649474e9102400000001f111421042740a60a7eb277b142c7227796f7292815b850a4a4413e4193c78a53900e7cbb1a0863223a5a4d713c60ec7607ae73df74a865f2f878be6dde8003 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30D67621-BD87-11EE-8A38-D6882E0F4692} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1912 iexplore.exe 1912 iexplore.exe 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1912 wrote to memory of 2620 1912 iexplore.exe 28 PID 1912 wrote to memory of 2620 1912 iexplore.exe 28 PID 1912 wrote to memory of 2620 1912 iexplore.exe 28 PID 1912 wrote to memory of 2620 1912 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7bf0b4514cd8d4c25bc0e107dc17468c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d003ceda65152fb4a800f487dfa3dfe0
SHA16df2e9703716eba20180e84dca69ff0bea35f8f7
SHA256c74767757f56eaa1ed907024cc7025d51ce027028262af9c00856b49ce2d3e7e
SHA5121146752f1f278b97b76b6996acf316661c9343fb0de48685ebe1408df861bd2bf8537cdd87add8146b16ed5bc9bf298f55c7aae55315c74ca27a8ab525458cf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a02998b46af85def0739efca254cc302
SHA1d9afda810f07897ed3c42f097c9f48ea59c1ff19
SHA256330ba9214098130b3f9cd4fc3a41de8d421314e13725611559008e52a15e2939
SHA51229cf818e069ae1f0046d37f3ac359fc11554dabf259357fbff16e0f20e969811a1a9002c3b53a52cfebc82572a82839f9f326ba83acb23da98f0b4932ef926ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59feaa0ac30234013f71b655a8dabc777
SHA1efbe539a6ebc9f6b8010c4b30e844e0db79a0314
SHA256f85ddaa8c2b22bdc672ab602b57c13cec95c2c8bcfb72e95bd26ed588f59d1dc
SHA5125a9a98a9b981d3ab1fb98ef9df7ed8e448ec6706de7e1a71b1caee5e54f4f0e66f4a7ae186012b63bd17d4f213397480484dba70b4a2beee4ad5771bdbcb4ca4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd0b3f2e74d3d470a68c2eaf07064106
SHA19c1dc17ef82ab614bb1bb42c16c20a73fc288070
SHA256266e0a847973dc1cd12186d8675fe2c17c08b1a265a3c2630079eb7eee095e18
SHA51217dcd6416e650f5bc165992aa28f9787a371793d8672bf1bde299cfb6382e4d299b32635305aeda040f8dbd0a8c4fae4afd7e78b6db29887442a807c6b8291b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a8c13f18d2afeb37fb81676a9aaa28f
SHA1d724d006ba24c4da473e4e73b9e3f626fb90d260
SHA256539dbb43f448df4d24306c4d8fb4dce0400c6fcc57bdf46bd956a1eea41e3fdd
SHA512425afbdbbc1ad093c9502e8116a2108192759c5be1e2d68de0c0686159817e9efe3244992ad16f472391ec004a29923aa5abc033c31f3bde10b43345078182ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c84a986a2af7681c786f665ff233604
SHA10611974cb695a8f723fdb97b12dfe320355c800f
SHA256206de8feecb8e530dd92a66fc846764217b7629ff229503746985aaa3bb4e94a
SHA512e33339eddcd18b5f4f34db09fbdf4a95b1cf213fbcd11def463b2ead71fdc006bef9901ac90bc2ef5d7b3d786d5e1c7e79e05ce240b0b0d7c33a5450fe477085
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c293ac2b9a618969290a24c8815cb80f
SHA1360a9bb1454eaaac1d5f9df714a1b1d4b9e672ed
SHA25645dd992a707e059eae73d145124cb4ed1e0b87d986ab7959277f849c011bf984
SHA512c428a9f45ca6db4a6e5674e5719b2b67df55e4d3ffcac3852e269d8de03d03b08ebc00a7dd11eb2ad5334e8edf0515ba69bfe47bb9ec3cc854dfb1ae1f6b0f09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd3518276da6bf4cb274e6da4101f39a
SHA133d1a0890039ff237e20ad499469bd75fd25b7f2
SHA256ff9a2845d6596fb6e35c3241d484135cbaf6253b7c8d045ebd34e9ecee04f81d
SHA512fa36eb1492ae104b9b34807226de03f44fbe29692d948123f29a9f536abf5beac6fb8f12be2698b1e2364201a3ee168ffda4011623476341daffde08c29724da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb676689110fdcfba252599e9150a16a
SHA14c8e49410387e31776f0db0ce97b8212f60eec72
SHA256f875b0648d537df537fefb2379971810487b8bf0fa5f0ec71466663e197f7f6f
SHA512e2688b7dcdcc3934dd855faf8af37562931a261c5ca8b94dbfb7d9323d1dabb0c01943ead852c320952840a68b84f76cf42ed00dd2e99d01cc806cc528ca85a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53290d483f64be9f95daff5f25d6ed7de
SHA1363dfc68ef2a649dfe642ec717352b9ff0be775b
SHA256b67752e1f8ecece9419c6125487944152b1a93a7151dff71250bd8679474998a
SHA512095101a4a0003ff0d52160d4004bac3a2fd575ac7c91514b62e2f5ffc028807e612b691c0065920bb19e153d6019a8d0424e56e36abcc4d5dd3ff9e8a3d34aed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546005171ef4e65dce75f70575ee1e35f
SHA1a0262abad0a76909619db6ccf809993ff0abc0f3
SHA256aeeb44b07d37bd764cfeb5831f208e54c11d145c53606c58b5d446a54c16518e
SHA5129fab95be61522c16718b349f4d17496422f061fbc391f0ed5662f3698fe23917956539446af878774ecffbe637fce0f6cd87daf6fa27b167e21684b9e8171db9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524299cb8589fd4abc920d94f7420863c
SHA1108ed96ebd00b7d871967d4887ae92925c60a412
SHA2561e706d0492163c1b27a52116a60896fd26d13b3ddd558ef4fae1d5b0c57fe1fc
SHA51214a61bc6708b186e2c18eba2f4d957f0961ee3c947af8503a1ffe59484a5777013779590fd812d06bf9efd16e9d7a0400dff60ad3183289fe1f94246eb3fed35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7463be99e555793fac51edf260c78c6
SHA1c283e6c0f8611cbacd47e3a0f81d504eb52a0df4
SHA2569fc90cab64af0b745bf939b4e8aea4530449907720c0121ce49327d1a5f08832
SHA512bbba91488abf17e61ab140c97717473290acde9cfd9becb3462d7fb7ddcb0bbe5312929fc62df847b528ae840b22119edd74f9535e9ad075580d3c19df3f1b09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c74da9e07253eabfec48bb669bcdd84
SHA1889c6efd9dfc71b275cc5dd9c4248f2c2d04b7af
SHA2567b4deafc35b46a1feb187ec413624a2cb4eaf6dd33291f2f616adf241ae8d9b7
SHA51293f8573d27ce85054be6c7b045178d36e28963b4aa0f95305c961ceba2da43cbf0b347c1edf2e20eb766eb07162453a7b91d13ecaf1ff00679e1c61c6db25400
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a35184d2b0388d7d6d8843da1c9f972a
SHA192543263b3dfcf1646cd193904bb81aa689cb799
SHA2565941708d174fd40cfc3e59d867eeeacacd4baa21756a1c6a463580d533f3d410
SHA512efa6c7adfa5fd95a882ee484a9d700ed49a2bcc2d1db7d70bc84837de2f562b1f79735346602ae11446234882623812b8ffe74869bf51b05c0159105cf8acf46
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9c6d964ab17efd6b2f9d48992f0ffd9
SHA16bee571523d821f34036a452e1366f2917ade0a2
SHA256c5dae19588985623c0e2536e409631eaa7d4ed03f6141f03c8d07eacb3ca6492
SHA512ea48d47039f55ad513833335750e31f25535123cee3313b262c8744b81dc0901457e07de04498c4c97dbacb765223e73350a781e1ffa352f6d6a83e3b2113014
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5becfbe31d17c70803a2be4372c7ded44
SHA1909e02fccbb99ded6cf4096f73831b062423b7ea
SHA25696ed6681655859ac1f3f749a0b6253dcf76bdc1ad96ae196ac891cf5984d2182
SHA5124aaec8fc6ff8a80210d63cd6dbbcd90898de9632000f9f76a393115c81f3ed67dc0f3c1b2aff74465c64da2f01259c15dd418cad92145551121be47e14d2323f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54457c16b7c3905f937c2b265bf91aa84
SHA18892b68f9a0304df27332ce35ef1f76be016f6a7
SHA256efb5da63bf5f1109035763a3cefc610da52211ce64a9a1be39bba6fb7f468163
SHA5123e8848d8866e5cc9cc3899d43ff15ba0e79927ea2dd6b81a1ceb3a0c0336d5b8b359c0d00d5d02748deadbe27941f6c6918cee7ef6a65a3bfec7297c0fb11b64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3d49f6bda3843d80c54ed1650094c63
SHA18a6e2383206e430fc2fbfb05716e872744b3fa59
SHA256d9e3311b129db72e3034465d1f37cb71329e89d6a2787211658275643e20de03
SHA5121c37cc800ec3452f67f447e9c3c68782e9f2af35a88f55645aba8ab0e65a3a9b8dd02cc973db96e00b1dbbc9b86b0cf5784f2f32d9ebaf23bc20647f71f09e5d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06