Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02-02-2024 03:47
Static task
static1
Behavioral task
behavioral1
Sample
8878cba34a102c35f12712cdb236580d.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8878cba34a102c35f12712cdb236580d.html
Resource
win10v2004-20231215-en
General
-
Target
8878cba34a102c35f12712cdb236580d.html
-
Size
31KB
-
MD5
8878cba34a102c35f12712cdb236580d
-
SHA1
c71b2f7317ce08b900e70223e5cd7b7ec9d81c4e
-
SHA256
b22794dbf7ada02f2ac47c6c50aaa4efdc146e0be0a37935bef6a6c7a4a6ab65
-
SHA512
74d6fe3466940f0bff5651bce40c6052180cd964b1b3c1d3c35d0a6e3bb3ee53416484b34d29f7f94bbb50ecd19d4cebfbe4b4ac289388275f5c566b935ed402
-
SSDEEP
384:4hJITEu11hWNZxJC1byriNjWpFgic7zmSTxOaYYBwiv4etNvw9LbM:4hJITELNZbC1bNiazmSVOUneL4
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000095d06f2af9a7843ffb9ccaa47510757848fe1fdfc3b205349ae5ed5ccb01f4e2000000000e80000000020000200000000ba4d8eb8e6a63decfbc40fc511fe0c8863d94272cf6fbfc6f866ec78eb0bb632000000017f1b1f7b5c295e47e022c85eb42a9747e8f500475271f9cfde5c9e47cc2191340000000b3a0292de31d73ae94cc5ef7d5411873c49febc4e27e6350a9cd380f109cfe8dae696fca8e40e53a9f7d83fe4d49170e504849371ace5a32e6508450e382a860 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05562aa8a55da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413007536" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000727cd5bfbb4ff8bb4f67fad476219258969764f5382401ccdd954681c59f4cc3000000000e800000000200002000000029ff3339e5d2fe566aa1f5692adcb37c206f484a48ddfe2ee9bd04addb156a7c9000000011a4a33cdd4ceefabeccc8a16c0073459c25ac6dbe92433d9532838fd9fac6501a4a6435ed62eb7f5ca4f843e653ed446fd22d5848af194950c2b2726ab584ba390b90021723d53b60cf4568b72ba3f9783d8b0927463d1f9b5371c1f94baebd81f6f613c4d3d4c84268a6018097a4902cba79c69ae428fab2b1b837ce927f49d35e45bac26936a25bb3f29f5dc68bec40000000b07b8d6b4a461ff02b3b171fcb12c11dc10c420103d02629dd6f193be5cbe3bfd7eb7a3c5b39e8bb2ca24064cc9e9c998db4526b0f22ba8a7535a023f6f07af5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D58C3341-C17D-11EE-B84A-D2016227024C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2440 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2440 iexplore.exe 2440 iexplore.exe 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE 2680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2680 2440 iexplore.exe 28 PID 2440 wrote to memory of 2680 2440 iexplore.exe 28 PID 2440 wrote to memory of 2680 2440 iexplore.exe 28 PID 2440 wrote to memory of 2680 2440 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8878cba34a102c35f12712cdb236580d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2440 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9e468608e1e9f77b17ecaa0ce673245
SHA11254a01fd949121ba923d0d4801359cbfa6df7b2
SHA256d0b854f7c348c1f74cf868a2d6aa81aa2efa6b0057ada020cce4af0cf371744c
SHA5120cdbd2f5f87ec1f674c0c3b78f8b649f8a4a52745b27ad7c6e9796e9ab55106c440408799968228d201e924fafbb436ce1c845c02ef636fb8b64afd9874a192b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553ada70ba84bea46abe055105ee86f3e
SHA1730d8fe40ed84121a7dcd66ee9b5420f59e71707
SHA2561b82a118874feaab3635ce1774083552a2aadc0922b3be0ff92c64ba4aea307a
SHA512bd0f20d75aa5c7e4323edfceae086559981bd7cece0c37905ad62b4b641e3d9a4ccf8da31960ff61c0c024ed20f4730f3d69d61fac7df554eb2a7183cb3c19aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580392242336cec31c7d53759d84965aa
SHA1e02b29eecaeb3603e00992312f4b32415ba1ca7a
SHA2566da160391633eb802776075107c4e51bbae5b1a0b5013f6ef3d9d9d74412a535
SHA512f8861510d6a530b26176736a2ef460180902683aa1ea3b3315872d44938dbd087afcc521e90b979f6ecda7327423be869f17de2ae707758bd646873a8683cde1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5041b6f3c22ade6a2ebaea03f706e4a48
SHA1210e13f14a5c020ca6e7040ea7cb31508e32fba2
SHA256eaa5bb2ca42b1b435d52fe5250c41c230e7ff88653eb74de1b5d10e570bf7a38
SHA512a87d2047b09cbac652f7d6487bca2ee3f8ef30b5590616cce636242df725b3718dc8e8820d9445210d19687c08970e47da3440e44c91323f8cb99acc2e7060d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9e75cb71d3de54202dfe5f2de8ae1ed
SHA176e42c6abc4f0adad05829c57a1198402c007cb5
SHA2565b3e2277cd8e8d0905e408c46ac899ebdd7da5d752700947764daf11b6be8357
SHA5123a8b28c66325b3c72e12b150cd004996a1a75751a3c99d211b0719a3409d9f9534b9a3355855e5d163ead6e748799bc3b9d955f6251578e850d8f63581083448
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b253c51549c129d045a31776a29d8437
SHA1354d5e88a604c38b0e52f562e5786666ff3a34d6
SHA2569827ae24ae48936b85a8bab21cc4b2897b6fb5002ca3fd7c7bc6ac8ce80ce4fb
SHA5124154637378b66001364c24f9ff1087628654ce74b762b0a538b392388722d5643c0f6c59b038747ad556a991132bb47ee76f0c1de0fc9e7f4f45d71780283e15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586468cf8acd2a1498ac17c6d46e1456c
SHA1d24b188280172d298ac52b7a28bb750c11edea5f
SHA25670a6df5287b42834fe8da79a6052760ecdf7ed7c31e492adfab1fba808f8bc0b
SHA512cc947adfa7ffd55b7a643eae4d85a92214107d36c696d3bfdb01cf0f5db2ea34846f08a97abf71994445d6bca375b3561666a8d5c24275db47799a278e54d214
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c7d1c8667e6dc13d21d06b753f8a8d0
SHA1aa28ee65159c4fc92eb8e11000900d2982bdfee3
SHA2560344968e8cf7b5fb5a4bf2bb8a5d951c0f24d83c5d5cbe3d8546db55e1f7882c
SHA5127095489cc1b171029e72b4ccc8fdd8e5be7b8bf34ea74df9f526c2a36c770aeb801c2a41d38767c3baa29d85075876fded3e379cb72cde43cae27960f294d9ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad5d45dded2fd35397d62c2e805a2345
SHA1445b7982df21d4892299e5d047b65e3c1507bbf2
SHA2562207674e3445ae25b8000abf0ebc0ade2550a9d713f2169cb95e3afbb185bde1
SHA512b016a0c8ea3972575d66dc2f901d36ff0ff058c22905b4c820f58631960322ea1223d5a9f38b4cf96f58020ae924f2a507f256b303d5174bf73eec5d45950c3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55470c270627302ef510688d340ae5d3c
SHA1880b53deb616d7eea9bbdc17b85d7399951fdf0f
SHA2562fb2f2e692d70017b9fe15a0abf7b76d06cf5f054811a35008a71be8679c0ecc
SHA5120f68efd296849e0eba39ecef4ec8456acde666bbb223768e387cbb132a14c86cecc76b56ba9d486f92272d0774534ef10e7bbbca25abc521daefd081655d93d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e3a08e18437e3dcffdf8beecd090cc9
SHA1974879cdd30a5620fa5af4e34166645c441545e6
SHA2567857868673c8a38cdfba8ed0cc4a4f8278c09e52a2ff5008ca76f011e09fa817
SHA51269bd0cb8cd24c4f791ae5a4864ab0522753bcc6cc53dac8b277f959213bcc18cefdd16ad42ca441ba5ac637e5a92269a0d8b6bda189c447f60cbc06ffc7dc6d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d8952d68589a7435853e51a86335923
SHA106e5a59250e28ab7f001f500ebacf92a744892fb
SHA2568ea285e9fa179686a782e97aa6fe4730ee9bf6b975e69278f47aadbff7f1acda
SHA5122e050001326c6ad8805b8bda104d86452e501c7668bdb432a6de70f22d2dba276c8e1b9abcf5cb5c70ad5d153c777119f57919c45b2e82266ac478b813e98001
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c77e8e87f10f55ba31d275fab93baa33
SHA1f42f9ee75f4e815b07ca7d5da2be110d64cc10f8
SHA256fc49aa91e2ae75fc432cdd4522e30453d87a4c384928e6b560e4aff2e5bf0f68
SHA512d83cd78f4c65bd4e8e74f2ebbdff19e823d417fae876eb90e0e33779f5330f99edcc6705d1db8cc2a78cf6ad23896f2d7acb469979fb57c04ae09be43a308446
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543339acc89a0cc91e1a63143e3966a51
SHA1038f4294c8a54cec761fce62dc28faf71783b983
SHA25641a14e43a8d2a2896f13758a02bca34d13bc938ac4bf7ff4ab3a0963245be5f7
SHA51283c5396ff43515d9fa72ce73907bca8f604dfc41bafa4a984739d786ff53a893a733c8bc1c65215a0518355e605f5c145facf8f2ae9c3660214633c537049f56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a73e27c2406c2e4d51d3544f66edea89
SHA14261de7c975eaf1183ef768e1fba8530ccbfccc1
SHA2561f7a06acb5c31974edecf1d87d324ae945fa6449c294d78bfd2cb218827abdeb
SHA51230dcea386f833bece2b6fee315f90dcb53c24765f49f8edf65e3e24079822690294325d2e778a28766bae4f6030b59384e995038b53a3ab1e424129aedf7cc29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ffdff0595070a27307f4877096bc98e
SHA1919d08162669bd49c55d467d84cbfe99831089df
SHA2569bde7477c7b1944bb02195256c8bb25ca8750fcf6da8d78a27a3824d478c12b7
SHA5128c593322f91f3677e01cf3f3ae4a09bea5ff0b3931321d5cd11ec8d5941f330142b8c95b06c3f1b37111c6bf789959711f582b72a9ef169b49fa9fa6d6d02ad1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d638d122d24d7e4c7c45efbf36d57f33
SHA11935362f9191d558f363898d190bfab6c2189676
SHA25658a13015bc2354738350098abf61a67d8698b0f61f3c952b2e9ffa01b96d7a93
SHA512ec1b4583d59113f5bccdd6fcff049287969f4d47814cca60492d41d1cf91210dccd37619206e5bf16582973427ea0b9c29c86b73a20779d41342c7570b1820ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ef4bc4dba7a618ce9eb0919edc2464a
SHA11ee977588823414db624982e7eb45850cb4883b6
SHA256f0a2e95974977672b34f0de6b2abbd8a33fe81a3ccc77e5161bd643ec5382618
SHA5124d035cddf8854a22fa4008a580af46e65ca98371a384ffa6d70f5ab2970dfbdd1ca06e563c29c10694984efbd6f0695e6b65d3dea9ee760d95fe9e5f427d2c77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b42071f9e51633204db4352b0d5da03
SHA12464feaf55f33eb1d5b87d5b98b862e1c67ac92d
SHA2566103a9f8f551a63dec2e0736bdff318356ba37bb337ca02790a62e0957ffb766
SHA51272fcb20e33e356b59be0bf8a7c4d0662a39dcaa2e0720e26121e05ef16a72c1ace96799cdf64f8d17f5d831728a94ef7b0a620e3eaecaadda235be2ac942bea1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06