Analysis
- max time kernel
87s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
28/01/2024, 03:44
Static task
static1
Behavioral task
behavioral1
Sample
7c0ea7b3ca211babd9419b9049ff3f81.html
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
7c0ea7b3ca211babd9419b9049ff3f81.html
Resource
win10v2004-20231222-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 7c0ea7b3ca211babd9419b9049ff3f81.html
- Size 34KB
- Sample240128-eahzmsaeh5
- SHA256 ae8bea9fb0c97123d1d54ea3a5f9b4a8382c8b95a9ab2425d9caf00e239edba6
- MD5 7c0ea7b3ca211babd9419b9049ff3f81
- SHA1 fcc81b67ca73e90ebd296efe424241081e9ddc91
- SHA512 2d18843a3edb6d06a25a4d7757cd22feda1bf024b161ee6e25ff72f1922dd42d0e56e11794bd545738dcb69e55e19a19d23478404a925b66397b17541b6b107f
- SSDEEP 384:uqxoUUrn0Bh51edWnCW2QZh8XKg2nMyoNHCHeJLQoTl+tFe37TNH53TLPgGZe86s:bKnWz23mg3Ni+TTpXN6I1/xUPvtiVX
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413178429" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1438599934" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1438599934" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31084956" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084956" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1442319583" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{81532235-BD8F-11EE-A0B6-C62A3EC50C5F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084956" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2300 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2300 iexplore.exe 2300 iexplore.exe 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2240 2300 iexplore.exe 84 PID 2300 wrote to memory of 2240 2300 iexplore.exe 84 PID 2300 wrote to memory of 2240 2300 iexplore.exe 84
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7c0ea7b3ca211babd9419b9049ff3f81.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 471B
- SHA256 801c05af90120efdf31e4dfdcc5e7f2b76b9ca0e0746f58fdf12bf99287d8aca
- MD5 55adff48fbcd7763c70a0d51d485d24f
- SHA1 8ba66cb09d8e16d22c35931083d443155d3a04fa
- SHA512 a3151d562469fd2412c237bb5646bb214a9a9f8664be4eb48fdf704d9710872e41947669f770ac74d9d1eb5d6ea5953e40cc5a85d57e56fc82708341154eee7b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
- Size 404B
- SHA256 998f2f2f8b5723337bdaa752ff06d9fbc9f71637215900d83cee684582cc7170
- MD5 6da8b2e16fd3fb2bf9af55921366c459
- SHA1 6036cd22a4f5fac3775f42d9e5aa6b6586fd98d3
- SHA512 ed1858833539233d17056f34407f7fb4fa01f753a3f097d1ff12752d676a43c2e48c7acad799117a13588f22ce1a21487ddca50934d98e994211482f7f176842
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BJCNBC62\geocompteur[1].js
- Size 5KB
- SHA256 3316412a1c6da1ccfdec86cc8bff284bf165f112d07e586ee200fc803a0439cb
- MD5 81ed28d9fc91f371fb9e7382b6199d89
- SHA1 12a76d4c612ee762f551fd620c454bdd7bcf13a7
- SHA512 4425d45cff8233ff23b0bd3e46d7ccd13d6d0b8bcf16d4c723e205eb45c609243f92626048fb7a46c33cdadb2241c3dc3544fcd24d8e17621f6bfcd31a46a90e
- SSDEEP 96:UnS05gioIY19Miom9FZRK7hmhxxgR5TDa1ic+tHCm50O0lww:yfI19T9FZRK7hmh3gR5TDa1wtT9Oww
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BJCNBC62\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BJCNBC62\tcm[1].js
- Size 2KB
- SHA256 8bf925f49f154835a31bc7bbc50244849a9da8f3245e16229e4cc97d6bfeff64
- MD5 06ddf0a8b0f259a26dfed291c29ddb77
- SHA1 49f35a96d54336148c27342beaf15a7967146de5
- SHA512 2cf32ce6d3d3678bb5c0ae584b0d4646f85233e2214c99d8640fc7935fa1f57b9f537f90e58b0a5550da65c4c0562edd2e54528ba4df34edbbbec2497897c148
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R977VUU4\js[1].js
- Size 243KB
- SHA256 a16edd10a7da4a778918a8034f6ca10f6a58a726af1f78fcf64eec32c501d395
- MD5 a484ab178d07a246dae2724e287164a5
- SHA1 52be3cc2ae171c408e0ddeab419e5ffffe125d18
- SHA512 2adbb0cf54b0c58aa60e2bb84a9e5e9053a3d101bae3002c2c3b4aaf57000d9ad8ea872286effa1bed2e4d5942573946eec01e8939a16fe18c459beef06e3f54
- SSDEEP 3072:oOl+xqb2R5+VmMSGchK3C8ET7q8i8uhohLP32PccJm0O10ONbvDoOwuD:jkt+YMSR1zi8uqLP32PzLazNbvp
- MD5 SHA1 SHA512 SSDEEP