Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 10:57
Static task
static1
Behavioral task
behavioral1
Sample
7cefc7b9d372024e58aee036380be702.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7cefc7b9d372024e58aee036380be702.html
Resource
win10v2004-20231215-en
General
-
Target
7cefc7b9d372024e58aee036380be702.html
-
Size
432B
-
MD5
7cefc7b9d372024e58aee036380be702
-
SHA1
bb97804952bba6e8f46c30d212541d5e3aabac83
-
SHA256
91e07877ad6349d7e72588e8ceb0a1fe232cdc20e56a91abb044b8b588ee8fbd
-
SHA512
adb3be8803628a68aa468d1bf90eab92f41d648d21ca8d34da6d1b2e014277df4ee8deefe9df868f95a91ad5f18df0344f0ef5589d8a60580f0d0e790e2b9a43
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000056c0f093da428f4099809f3dbcc1bfee00000000020000000000106600000001000020000000e4ed474aff2212049649fdc35f2dce6836361b7e1d21d3e497dbeb09b0134b02000000000e8000000002000020000000c209aca1014b7a51afd6e47f419703a6294d9c71b604a018c5db5c04607e5cc120000000bc62fa3a15c6a0641a51b904c8a6bb563918fcc72d4a64a11733d8daef90907d40000000643e514f1b0b8d69c357a9d27acf2a5de859014ca6ba5a3c672b551eeef1fc7516efdda3a8b48e7dd6beaa8f03ac3aca90181b103801fed8902f67709d4ff3b8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\Total = "39" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02cb9cad851da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000056c0f093da428f4099809f3dbcc1bfee000000000200000000001066000000010000200000006077a433ac96da14ec38d241905a75f35a1ded1c08081cf29f442af8e166b359000000000e8000000002000020000000cb44c6d672fe924dabaec45b597323e890c01c7f8289352577c350b2ffc817ad20000000ca52a5d450a2c68d626fc61f3f6fa5a90d5f8cc1ba21143b580a52172b86586c40000000fa38e05aac2ba77489a6cf02c2f611063f0049a05ba0d6cd60265276fac829f049e22e9184cfcbbc31526a9d6f1fb6dcfd28d1a2f7dc1ed6322b0467b5441bc0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.opera.com\ = "158" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\Total = "158" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DOMStorage\opera.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.opera.com\ = "39" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "39" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.opera.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31085016" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00549cad851da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.opera.com\ = "79" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000056c0f093da428f4099809f3dbcc1bfee000000000200000000001066000000010000200000007980668a09b2d482b5657ebc0f38b4d7cd4cf9463207b00cc803c4ecddfc1428000000000e8000000002000020000000816a391845c600eecbe30ea9bf6e14331415f9f69f00cd1221e1398d796667ec20000000286ecad99666340a47eb91448b973b626d760abf4799be3c824e416626ad444540000000359838b69c3a7fe00b19d6c56b26d4d105fa86ffe6cbd4fa98d1c28e3e720d05c8e2102b7d25d1bd6cf7d623fdaa7fc5fcc679ca8451edf3e2538d002b50d918 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "118" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3663498240" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0600C4B3-BDCC-11EE-9BE3-42E20219F0C2} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.opera.com\ = "118" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "158" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09b10cbd851da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\Total = "79" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\Total = "118" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3663498240" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000056c0f093da428f4099809f3dbcc1bfee000000000200000000001066000000010000200000007e4189150419159cb944cfa30c0b1ad74b9f7ff8072022c904b96f9a38fe0c70000000000e800000000200002000000052c14058869bd036b70a7830cf93d9ba67cdcbfc4f0d2ab033106e5e09b7f8c8200000005477af12d5a8d69e60fb59f4eff480558ede7d61c5b8bc641fd7e60731049b0840000000691eb360f037995261f47ec5f6148fd9e0fa6d7b561a0514b54f02eb202b641c50ab25d4fddb5e584634223691b5ff6caa0a528941544343d06399d7d4379da4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31085016" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "79" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31085016" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0bb5fcdd851da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3673654707" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413204422" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3500 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3500 iexplore.exe 3500 iexplore.exe 1164 IEXPLORE.EXE 1164 IEXPLORE.EXE 1164 IEXPLORE.EXE 1164 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3500 wrote to memory of 1164 3500 iexplore.exe 84 PID 3500 wrote to memory of 1164 3500 iexplore.exe 84 PID 3500 wrote to memory of 1164 3500 iexplore.exe 84
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7cefc7b9d372024e58aee036380be702.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3500 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1164
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD523c885d47568a0c8ec78d6dcc163d3e6
SHA15784bd843fecdfcdfdd6c213c092c65613d1f6b4
SHA256c682f97f831992d9fc18392f30e050457a49b6e15de26a1af4459541c2866d80
SHA512329f656e73d533712901b9dd168555670fa8ca2d89aaffbc5e446f734af2eb409c54cbbcfc72b9173a65d413bafc4f74c47d6985ce15767890719c36f6e15fa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Filesize471B
MD5f239c28141b9e3b11b4bc748e3bf36d4
SHA11dc5e4f48366f9d21d1c7541b1f284437376297f
SHA2560413ce38a5e1f42e8c3593851485cd7f0f1f0401411c7704f6c161d1b2e462fe
SHA51231034739ec7eb3beea34c22dc6b808d42bd7497aa7bab49126991f9eb7e02a1dce67d12230b0d63d417974246929f87d5b70a3531c77a8da91c04499165af475
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD53157fdf95687ef68bb437fabd77c8f5a
SHA19e8c8fe4573af860d767acc493ebad47e4574e6d
SHA256d16cb2a93c1ce47379962eceb0b139b95493e526cecb783d1e1e25ac00cd0e2f
SHA512eb9f89cbc37cd22bb013a310c70ad1a2562154b2ddc8b7d1fc5098842f6e520ed2af607abb3822f8a4b2fa618d191da7d4bd63eac36cb9972c9fd2253a6f5c0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Filesize412B
MD5d749bc71bf76e1d02040d9d28aa1621c
SHA1e807f328d9c887a49e6d28925bb20621fc11380a
SHA256653217e4ba9c1e14a330068d0137284e3471c23be0469aa6cd5a88b1f34c9b51
SHA512418e3f3770b309780f89e2601985dbae5b7e5dfcf5b8bfd0a9d5b376aa70ff763ae3712f92ae47172b1e821e7e7f7f28f48cb028dada28da4b0268d4de6c5c0b
-
Filesize
6KB
MD5f8788b045c7941ff175421798602de02
SHA15635880d5c2204583b5c7c4be37003adad93fb10
SHA2565e7ba5251f871e906da177fb53a4eae32ccbbf7ed774e0507e125df92b259f65
SHA51247c48f371c1799b6875b599576a4ba2a8a72c88f550218e2e63775dff005868bbc1cbd9f481240397028ed06520f202dd9cdf25a0856caeb4db13f3c55aa8273
-
Filesize
1KB
MD5778ae3c595f61028d7a7f1f7610e1eba
SHA1a4c43300959ca007d93f1b6f07158c12b3b705c4
SHA256e44259550ee24a66fa332b82905356428e3a47751c13737fbc2ea8142bcad6c5
SHA5125a6881794b4850c4ff7c52a8dc0c55f1f9138e4b250339fdf115ba00ed8d1184030945037ffae537f46724ac7fd9bc0ea490ae70c874f92c772316e16271ecf7
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
1KB
MD591abe01116ab422c598e9c8af72cf4da
SHA10f2815fe8e067d48537ad168225ab4674271fa27
SHA256b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
SHA512a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c
-
Filesize
5KB
MD594e3b24366e3faaceae2583c84668c09
SHA1ea70800d14a0d3c15fc98ac0c4b1568226d637d8
SHA25607e8d69985547e670f5752809928fb887516ddd67e56d24c1323b4abc88723b3
SHA5125bb08351d4e875d929aaf216af2a9a39277fdb455d7ecef7f3a68bdcd4de977ce782e59ca85a4f5406fc68b30b4c879bc949bc44ab271b61ea75c70ccf6838d6