Analysis
-
max time kernel
119s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03-02-2024 05:41
Static task
static1
Behavioral task
behavioral1
Sample
8b8a33532348921a9b859afff9c71267.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8b8a33532348921a9b859afff9c71267.html
Resource
win10v2004-20231215-en
General
-
Target
8b8a33532348921a9b859afff9c71267.html
-
Size
23KB
-
MD5
8b8a33532348921a9b859afff9c71267
-
SHA1
741656396e3bd9f87643e45b76cba6a9de9065fc
-
SHA256
614f3cf5ce11330e0ecff3838059c6a69e08bd52404ff9ad7a9ea1f561833ade
-
SHA512
5e951a7a3ac85fd72664f964591413673a175aed07a0a7fb0bf0925e35a5aae5fdca82c28387e2dfe5237e4895bd28b3cad4b1fd2b8790cf762dd08dd1afe7ea
-
SSDEEP
384:f9N4WDUYbzfplNXZ6yBXZXQ/mopFPEmLvmRyk55oBSkRtEbo+mr:f9N4WDUYbzfplNXZ6yBXZ3opFPEmLvmK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000001ff81f9c99f9ba74fb7ad03aa1221bf63cfbc815047c75580639980c6fad70d8000000000e800000000200002000000043708862641855bd5ff5883e7b1d08d2820e71da97c18855355e5318aea2897b900000003afeccade53b31d0236570523366dd8f99e22d35db59856a8998ab1c81ab1a2703707c4fbbd5c7f7fc728b6ede94b29a0ca8dadafb018ef3b41bacce0b9dfc2ce81daa048172dad63b917bd53d462ab9fb64fec35808f6d594eda4a4bccf60ba9c0cbd66635f3108dffad6f585d3efcc72249f1cb6e05104ca4436188e6613bf2669a6844cc3eca65a62f59d55d13fe040000000506a5367b105b1cea51cbb0f66eac87a062c3eb5b59e9852aabbe9354cb2dcc4787b60afc96d1e7412e8fcb23cc641e8bf238439c2351d6362fd9e31b6996f90 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413100787" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08d31c96356da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2290A81-C256-11EE-B36A-F6BE0C79E4FA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000c2a333c65ded945811dddf79c54abd1f12f509d21035d603d8a59526e8d3edd2000000000e80000000020000200000004cf55c476ae1e074043490faccedd5dc787af1b723169373129d53932efe31d220000000887b2ea20b6ce0ee2359a22dd93419e1ed5945f8601005414a53664fce65aaad400000005380682ae6e0647791dc1f978eb63f0be15b98c7131d032dfaacaae423d93d5475cc692ff91d7e7630a3c64c8996e202c16f0a763fb0edd5e5d428f6f3fba739 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2148 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2148 iexplore.exe 2148 iexplore.exe 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2692 2148 iexplore.exe 28 PID 2148 wrote to memory of 2692 2148 iexplore.exe 28 PID 2148 wrote to memory of 2692 2148 iexplore.exe 28 PID 2148 wrote to memory of 2692 2148 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b8a33532348921a9b859afff9c71267.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0e3b2c4709028e7b1b30447e58f2399
SHA1ad00c96dd509d33f499ff1fecb124e18b3488697
SHA25684129d5de907f9699b535af14addde6f8a4f33018793303944264e58f88560be
SHA512db99e45f7a67962041208c044097ca1bb28eeecda59c393d4c5ea5fe7046995aadcc7deb991d1c9c449ad8bdc904d7bc3994222ba34981a642bf203d40c1895e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5228d5c2623ed9c6517f993bbb10b494a
SHA1a79f796548b0b6c6d1cb532532ec6551b634e4aa
SHA256c44c30914161bfc17d788f75ffb490ee3f1994f67c6693f814ad09356a01ee80
SHA512d2cc411864c6d187690340c55c80c05d8dc4607f9af4be0bee095d948f813fb5a5bd170c644ee5a514e648815fde2df7477c6cb2c05b43e9f4bfb96d17209115
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a7b0b31b21da53917a0954a947c04be
SHA1b8ce0c09ff6bc1a6fc38383d073fb231aab86f8c
SHA2565a70a5079077887266497138faa88e4ecb581fe884acc5cad077392a9b011d72
SHA512bae9f8635743a3b956179e1ea80ddd16d367ee856747476330fba7d8c79ceb259d5f792118efd41ae8fd7d4f882e31ad892fc107dd2962e4dee9d34b0af0af68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f52afb497fdfc6367972f9ad69320f9
SHA14809020be849247470761dbd7b734bc26cad78c3
SHA256770909021f323e1ef02d810d5fa8dc60d6fb0f9b823de1415787962c51af3a8f
SHA51271cfbbe40b90c52c271f7bb45d48c00bda764204ef9c9e1855a52c2dec8469deb75717ba535b6b26d49fdc57235b8457c18f66a22ac337006b78868dc530b179
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599aa3cd060c3f34282ddc078b30dd29f
SHA1d8734a41394a11d79714c51b54919be6b96856b0
SHA256ffd3f57a763db0a70a584309c915ae67c280bc925a3e07d2034344d072c2b38e
SHA512e0bcd6a93e33801a314020df1c99474db0f3a8f7f9c061f2b7497e5b3e22ab30c0b4cdbbfdc8ffd62a1e9683c8f04900bddf08b5d3074d6c9f166e08781465d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5044b4cba560d8774c70fb74653261aa1
SHA12d3e513df566c4c5619c073a29dff36a4ee9f321
SHA2565aec96c3d61e951d2a3719825f046dd8ca9f2fabf29f94e3fb75d69e2e7a118b
SHA51258455b82d683fc17266912d478adf034b1df7810e853ea4500194c55a39f39e8b696f263dcc441739cb22b474c991db2b3519fd9b2134c5c7fa99817510034b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff7cf6b0c6a971dce45bc909808276e8
SHA18eea7ccf8b81c190aaf2642a8d1e8ff2a8255e19
SHA2568b1b6076df6ad5f61c4a30ac9a730bec9e57249d4b41095d0d10613f1a8a5958
SHA512b2b6ff1b81306df3e394d85560d46da813e0daf4a3ddf5c87a298bab144900ecba9e97f61a84ca91e54058f121fbc0f996dacd99c146aba7be9099c12010315e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ad3cde4723c34755d58258ee1043ef7
SHA1a4e028923a6b03c4ca9cbb0e8e340fd5b00b2997
SHA256b7383cf3695e5f946a47bf489a07cc6e859433987ddd18a1606ba1e07f07e1e4
SHA512b655ebecd38ddf0cbfd3698a7f5db6646940ca7c14bbb20ed992c144fc5dbaed92d164bdc53e962823f451f422d31d4d0d9987e1337540348b0cfaa16be88309
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf9163bf6f65e138b7f00b0e6da964bd
SHA1cb6caad8feb795211740236a8441b34b4e23284f
SHA256a50add72a6885c93b9027d6a49006b33da0b371c8a077dae2882d373aa362bc2
SHA512ccf0529f18ff4e238f0c20e61f4ec06769e088bb2a58e36eff6cca620572ffcf79b561a74f24d56fb19d1822bd716df43b5cd514146dfd95f2be990d437b8a58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59afd62614125e330603a4f3a3ba58f4e
SHA1d94010d51b95bdc643ef9f0eaac6bd3c6c7b3dd4
SHA256d330dc5d0cc4027189e55a03c58e62afea88b2cac0d385fbd704f11f36dfb5e1
SHA512544967b65873579755e8f346acb81ce0376649e63b6eed8a6cbdc5fb46855581890652f6100c1eaa802f0d0c31ff5da4d3215021cb9e6ee2a9e00aad2cc9c3b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd716bcd627d0b3a6aaefdd97a8c9a52
SHA1d27828f53beb10bf8cd7580b51d94709350f7d21
SHA256ff4292e1917fe13a18675d9b460a8a7bf8472b16f0403fea30a025eded2b68b5
SHA512308791e468b74c9223dd41885edc189ee91e7a0853c62f44102c9fa48aca147819f14bb91b9eeb75e585b6a1b12c4bfcd05463affa0903b814081009b8b38005
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55618975ef0cc05aa4124427fff869818
SHA13db995e7ac096c35febd4069f5d7551cb111ee7a
SHA256cfbfbba6cd337c3898b9c3d5451150d73c65f487a9527461cb82ba8181ebd8b5
SHA512e0d145e8465d4a7fae32347d01e988c342dc62e505c5dd60060cfebb2d469c7f0073ee5086f258f3bd97e23f8d77c6d9fe0a49f240f108bff3ec2c52ead26775
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d80ee5df927cb966d3645a39641f869f
SHA1af68f90bdb615988f2213828a5a1a5f77185f4f1
SHA256236ab3d8087284078ff4915708c78997ea17dd22206cc0c23ebd962eb34b4651
SHA5121ea2f7f3360fd76edea171ce985b7935944576f3a70d472efbc6d84b5bd330e117ef22696b1a183bbf8a316fa35d1ffd155f69a73f951e99963c6d6f3e45a279
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5218bbdeb92a566e6e51346a0fb047778
SHA1f74ed3ff5e7f686f935152a83b71bc6aff44e190
SHA256481907f809acf657b0f74a1cdebe963b01d568dc78b67eeff93fefafdc35a72e
SHA51226a3b3bcc256cee33b13e49b3dee6853ff39b74ea3c0fd62032b172cd663ede05050ca52391502f650c56d38dc7c888ebcfa40d3f629e16cbe7f20460d439a99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3e061c55846f1ec9f5d190123ae4a67
SHA1de7eb9288879d34cfa0b0b8306f9d8abf76cd5e0
SHA256b58fe99ff28d6a0addee1f3025f136c6274889ce5020cdc71dbe8ca9de993dd0
SHA512063df5e73400490619191a26402532973e5ac386f40641c0ffbdd04ab9ecc55c7fd8503a094dc4c67df648dd68cf1fe3c90f9c4115155731ed368f6b0071c671
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dea9dcafaa73825abb62daa4b1812a53
SHA1a5c8a53d3d1bf6a30775c2c502402cba4620e043
SHA2560f4f9dde55e33ed89da1c6db34a5d4099a92b6d6fb46b420f91e96aa269de304
SHA512bcd65b1989347d141dfc8ef5b62ec1d462b5cfd619778c5cb58ce368b221bf2e7298eb39d6ab0e6eb993adaff33ffa9c20c67a72155ad08cb9cb5c88cbde17bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e5a624bdd671a45f302e1c320cc29c9
SHA1ad776f80efda7055acfd676f39c1d1c69e06615d
SHA25648e8480c46c90dd09962e72b4695e5ce041f4f6df5cbeef97f41f736d5619792
SHA51279019d8487f44fc2908d83ad4d611713dc8bf5c1a44e36e6a34a3617d3fae9e295cf64f4ee9b0f136b274fb363554a24386d558c1dea44ae68a58b05bb75f120
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06