Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
8b8dad2fb16a662d6c2e943ea179e1c2.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8b8dad2fb16a662d6c2e943ea179e1c2.html
Resource
win10v2004-20231215-en
General
-
Target
8b8dad2fb16a662d6c2e943ea179e1c2.html
-
Size
6KB
-
MD5
8b8dad2fb16a662d6c2e943ea179e1c2
-
SHA1
caef91eed43c346df3df401ad1239b9d42bd4ceb
-
SHA256
dc2597dd92fc880a54c8ed66f02fc972773f2ef3f7a454c7644023a8eba1f545
-
SHA512
ceeb23585264cdc11d6c3d99aa6946209de36d24f02facbd4bd8dacd2b6817517a1b419e7d3d75c969a4b56c180759ba0a4527ffb291bc7d15e20f849f87e0f8
-
SSDEEP
96:uzVs+ux7rdLLY1k9o84d12ef7CSTUnZcEZ7ru7f:csz7rdAYS/+b76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000045e5e35e77801ee41673d28ca8589c7f18d22be759bab949a6f25ce431e6bf37000000000e8000000002000020000000144f9337eb4bb926ab64cf47b750f5cd4c9c3a5ba17fada85e84d7a1f87f338820000000dec6213e22e96a2909ed4a0f7ded83f3fa7a7af2afd14d4b0f6c124da4beb2154000000029eb5550f069ae32fdf6e5b28cd9ef43d12045a57eda5ac30bdf21a0d73e8bdd57e727aaf58d764bb461ca5ee29f8bd11a866ba8233db7425ce2aff3c026e7ae iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413101187" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1E6A321-C257-11EE-B5B2-6A53A263E8F2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02f4cb86456da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000dba54375a90486e7d6c4590dc26910f12523134f7343dc478ebb64a1a7c536c5000000000e8000000002000020000000ce1eaee6c7d9963983f57f1864d0e7f129bc6367c6f711eff817367c7aa0441890000000968e24baa3405bd7d5e06da625d2d84c4d54a8c57ec85eff8532bcd70faba5dd52b5f9b7c157447e3cc45bde57c2cc7694a083ee019b1284a76fcc58f614fcc9fc3cc85c035ee10731b619d79ad0e968bacd439e0161d94fa69a409740092ebf66eee77f15ca4e169e38f51d0ec6791749ba6d8500c4be83ca5f3189bc31575e289d8049e31fdf34627f2937bd1fb0c94000000062b29f32f02846cc00b5c033cd34140944be1e35e715cb4079c20f9a5c143142d5e7d73d1396e274768e0d902c99f3f7259171fa04121716197b54e81169a6d7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1984 iexplore.exe 1984 iexplore.exe 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2068 1984 iexplore.exe 16 PID 1984 wrote to memory of 2068 1984 iexplore.exe 16 PID 1984 wrote to memory of 2068 1984 iexplore.exe 16 PID 1984 wrote to memory of 2068 1984 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b8dad2fb16a662d6c2e943ea179e1c2.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcab685880608eca26884d9308cfde55
SHA12af33557cbe72b70a16b2844118485a79b38d577
SHA2561dc5516d8dea3b13975b85f2eac1587f9faef5624fd8d82c25b346a30def34ad
SHA512f2712d70008d1cb80e0ba6baae37000f68c7030b5d267a221dd84d67d4170dcadf3bd22319c845b5e1bd665bf017e75b50df01b50bfb44eeee74e009754ed7cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdd5bcb3bed7e955b36d8ccd46de346c
SHA16197964903c9c7642ad2a5109fce33dddee5546d
SHA2568ed0e2efdeee17d3a315341f09fcd0115a12468d683f356e17912fd6dbe3364e
SHA51200c6f1ee3639c927227305f8aabe709a0de32ffe25d42d6f252ca4ed633f7edd32c52e81a19a20f3dcc3f244f238344fced47e6c4c55fb4297f9b73c22da5161
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5688ab29f9d5ccf571eff4abc9e94a678
SHA1a02643d6de3c39f196650e87638ba9297b8770e9
SHA25640db02068082edcaa99171f824be8fb5c6326a319f9c5123658d683bc6a2a5e6
SHA512b0349bbf906e3b49c0507fa168c4a43c126d57f31920b109a7ff0b01262aae21cb441752161e6933e6dbc47e8db996975ac698705f9e163003a37765eecf8973
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504413b060f888f798861a58675b31a9a
SHA16eb69681133af277d4825e4073129d1637990cd6
SHA2562190394a32a0a764578c61bfbaccc41f19bc6c2f94e7877a8bb26f9ab00e1853
SHA51253ccc09d910d92cda31aa2c83cf51f955b57d75a426074b3cfb6b905e18e715476931c29f04b81f36b8abbf852975c0c88c525ef579340e705db80060c3e03f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d1692aa12393377a55c66821ed7768f
SHA1c14a04c13a0cdf4a7e3df927b7545928777398fa
SHA25645a7e89c6f56b46528ed08ce083091490809b25401f0fd6e0e9ae53025cca4f1
SHA5120cb20336311796d62bc533b3100ea60d62504c5db48181465f6861bfa873d1e3a6caf71a295378073fc7829c601094fcce3aee58b9f7e64ce4afa6fb74ddf817
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502fb73e0b66dca4ddf9b26b9f3417cfb
SHA1997341344074dc2d89c5f5c90a92acecc4c80650
SHA256627b81f96627470cd36bb61ad71b363ad0ec2adbd0df249cc0f2cdf4e09f25ca
SHA512158f8ebc631178c882d54f3d9d88e6bd25ff643e4e714cc4f2e0a31952cee619ecf44ec37e20655c96257d60ee8e2044ebec321b585d298b64d3a44c1998a0f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8bc3b9cf2b90894aff629c8a9eb3f88
SHA1359d6d2fdf6e493d51e3b446b771835659777478
SHA25693330d3c997a8b19240885966429ad0c57ba6a784dd61a776dfeb21076342644
SHA512a695061f25d640c3e2031592248168944cc838467862021c033bd43c9f00b8e646c545ae0b26c0b38274e1997a51b3a5a51a96a44e7b7c092fa14eccbc31ffaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa31c31157750a1c24c98127602e62bd
SHA11744dbb85029f10469d773e32c95fa36cd72878c
SHA256256b8f36bc0b15139fce713e4715630d933a5ad8b956174650f0e11f941370bc
SHA512567decb5f9b7ff9e1dc2ca7b05650b8a1d8746ada493741edd70f80ffbb10e8731de39492228f1cd7abf5e6ef189431c43ca3e71e68f1a1c5afb45f5c412936a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a83ac8178fc2535314588016141c8a16
SHA1f7390acdf0a9fc0c2ce3a9c6a8f2c95b85061c6b
SHA25629c32e9578fb26f82b91b21a8473ec09b94c35733b4cb2b40bafe0cb51c8ae5a
SHA512f695e8de956786c86720e4a13fd109d53dd6d0bd4705913bdadfbe9847de06137aa0ce4d5859d43f0dd15ca9154dc8e283ecd4b996009dc5af0ddf590d0fbac4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52586406d98e470b553f4103949f19653
SHA1d36fc66d90307087af029dcdbe57abdd498c5b38
SHA2560a2332337fd967b4ea873dd64e2ae900b8cc94178c6507bffe854857c4254cfa
SHA512668b110a3c923b6ea2da12b67b56f4df1896b10b4e5b94755b05421c43a19c711aac9a7b11636f970bb33f1c4e0352549055deb2daec81523182befb1db3f616
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538da50303f19a87a87edaecfbaa14494
SHA1cf6ca9560fcb5192d510fc6a5e86e20acdb1f3d5
SHA256a8d80576fbe0cbc4c98eac21a39fc03dca4b50fb47d823ab30be4000ec88f980
SHA5127d711fe463fd3084261bcdffab6d8f560553f553c7919043ad9582dac9679829233def96b8aeb85d91c6fa1079f3b88ec667199c7974fd798a850f0f5c7dd923
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50888038c5bcee653e84b6442ed2bb7bd
SHA1e59630274a7b182a10ba19576b9237a656fd788b
SHA2562993f24c0aa431dc429f6fc6107e97336b43cd73dc4c3170831fa948910db5df
SHA512fe054e4de60d1fa99824d39129a7c6f2905a6833d923ad2bda7d2aa80520339e83fbd9d008cc2b12a1e2f1269d95eef645ad8327c77941893c30d0f98fa2d975
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4db57dd55aa571db82daab7e6212abe
SHA1ce15eccc046b135b6d3f3c599a624e2572fbf637
SHA2564638d950335d77f09ccd39210740319b1e19d4f0ba688a5ec67924858096164c
SHA512786895ff32930938608d0a29874bcb7ae1bc613e8382bb3fe7e98baa68ff06e9bd499b8052dd375ec1cdfb50b448906e17b8312127a6bfbd6748f84ed9652d1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2db7076e01cc6045c0b8a9fd2c8b0b0
SHA13bba4d87d31ded57296f32eb99f3156c7b86096b
SHA256b90a549e1b84801fa1d0c81d2387c69a4aefce3a10de2a05e1cd32f7dc793a2a
SHA5122cdac80bc6908d1af1922472d42fc707316d4f5b5776dd8ddc32f9c61d9dc9fbcf0feb427aac36b3d5192d2ebb5036efd599163d58bdf211f7797d84e7691707
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579b77c4703e931a3716868aa907e80d7
SHA184718adf57c2de8dd21659331af1c055bfa9d74a
SHA25635e28ecf11e19428764c742931793faa5e53f18601c82b836a5ca3318859a6d7
SHA5128741ccb368dc2dc7e5ec1ebf3aa6d4950fe994fe2e5215be4f38bbf91010d76cb613670b5014d9c07f47a714b275979535b5c31568fd208c6cb9bdb7ee759cae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cc0af6a77dda6e24e59200a580d840f
SHA14288c0f8ddcc73f94c9aecbdaa2289ac2972711a
SHA256dac03a7b5bd46de090179a3fec213ade4ac816c187e3a94116067f5b812b6772
SHA512ed3c8b56606a785049a71ba73119f621be132750c24c2729fdd661fc4be37b08aa700f000d32360e1b0271603e24996ddb12973b3cd026cf699a01ed6608b67e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df8a3f3e7d66102e9fd262f1eca31c20
SHA1a22bd8c117b72ec10c6d2382eeb9691ce2ece004
SHA2567b9436a0180aad2eb09cab15023924e1f7c358f8a4c7525de32d94c203ddd634
SHA512c48c58b0eaf198070fbb295eb2acfb75f9b6a9820afe034dbfd444f7408cec4f850fa905e243f6549a36f427d264ba109e41752493cbc677d3003a259c0914b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bd751592eac3961b0e1e451a52bf4cd
SHA16aee93fa18ab1f248ccdd04578ddbb306aeb7948
SHA256d869fe1bf5c6d622f8d1661ee75be21587cece968988dda128fc8c4ca842c03b
SHA512c834321edd0b5e5278edfb865d007775f8612c088e5d8841005d97c3ea42c6aa32302a747e1d134091cb42b772becd0162c5bef55600b10b10db990a10e6769d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580f91ccfde2ee5d684fd614de74cb851
SHA1cb7b74ac4a0eaec6d4347a8b00022394910ec573
SHA256d73ea3a20eb47066804a101bc96d9c50624488bd5778e56851524c5cef23b3ca
SHA51260ab2e94c838d1619b37d0945c1c01fd4f8e749a93cf9cddc3e20d6e0d1c5f7e079c107c62a04212a1677d7f8108b1a5487e97ee88426bcae1f616315bbf3a56
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06