Analysis
-
max time kernel
117s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 05:51
Static task
static1
Behavioral task
behavioral1
Sample
8b8f0bfeca54fa809a4682c0e8a09581.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8b8f0bfeca54fa809a4682c0e8a09581.html
Resource
win10v2004-20231215-en
General
-
Target
8b8f0bfeca54fa809a4682c0e8a09581.html
-
Size
17KB
-
MD5
8b8f0bfeca54fa809a4682c0e8a09581
-
SHA1
6b788b00f034de6a8346e2720929fe1a5d98c164
-
SHA256
e00f2a6195cf009ea26e9bdf0f6611b8b1327a9f8391149c6dd84b248d7d255c
-
SHA512
94153aa6773504ace4cf6ad123195ddc6b992f6a7b5b735a181dd87a84c376304fb79f4d3aa0f4edf66ab0b95117385b1001c50789b6b9f5e595ebbea514d5fd
-
SSDEEP
192:bNflIsrnZ0t04n7GTH2hccSfrE+d2JH8k/w1wvqLkw1nsw8uBuLbdU8d:BflIcit04n7GTHJfrEaa/gRnsw8guLZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c010df3f6556da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000066bd0da41ad6cf9a801d2d690e2490ef64837b9baf5e2d47e2cb6c6e0d2d66c5000000000e80000000020000200000000f3932a5da0973d4096477b8cedcf27381e96fecaa298f8ac6c39b37eef0916c90000000baad5cd01bbef6efb4ab419b4860212c966be3387ad7e1f114936275545b0e61accc113ed70f415eb28cc5149cf6c96c16525de02ecb152745cb9e806c56f865f7b786133046cb1358462e65b1e4607203f4a44eda85b5a41d3becdc35a8fc0338e6a5846b0e9170f7b9aab87170f0bfb4d37bef3520d82737083e296723eaa5e94990197310e389256ee2c407102ad64000000079fc32e45ab592220960ac4d3df18c1641ebaded81acab78a880de042428bace61b64dbb37370ddf0e840c240b02a4c4ddd6a14a296fcc8b2dcc05d31f6a610c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D78F581-C258-11EE-BF73-CEEF1DCBEAFA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000068b5c5e7c650b34b451b9ece20bd7de283708671967606bad37858ad054c93e6000000000e80000000020000200000000e70cca54ced8e747d43dbb1e495b6d450713f1bd91995569bf2518eae20a1c42000000015a6bc9bd1d73e7fb315308d671cea8f778dc04e603d637c9a095643b70665e140000000cb0850ec0245749a36472721333ee81cab6f555ed81c94f585f32697beaf457cc63d991b2821d8cdb85dbce8aa98ba2dd59ccd9105fa6c054a24930a9882c03f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413101342" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2212 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2212 iexplore.exe 2212 iexplore.exe 1120 IEXPLORE.EXE 1120 IEXPLORE.EXE 1120 IEXPLORE.EXE 1120 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 1120 2212 iexplore.exe 28 PID 2212 wrote to memory of 1120 2212 iexplore.exe 28 PID 2212 wrote to memory of 1120 2212 iexplore.exe 28 PID 2212 wrote to memory of 1120 2212 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b8f0bfeca54fa809a4682c0e8a09581.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1120
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5111f7acc1dfc29647c76f6003d5c8a18
SHA1e7a7b4b0965a5b873eb84531ee4e95346d714607
SHA256609f10c5f93faa238540f1848a07682b23491704de492da78d5fcd01fa24bfbf
SHA512f286344fe464798aa542362b0b81adc273ef2cb2981624be825dd6e5464fc3fff7b73c26c1676fb80ecaeb35f6702523c99ad465064fde20b78e1947df16044d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d6f4627c8200aeb0d565caedf6d2711
SHA1191d237006819e8dcc03d53e08fcc46ec7ca1df6
SHA256e42a49752cca658a2c0b597a9afff26d847d835d5f7281859ab5f5ec265ae273
SHA512ba6c368fe174b9f0e881b2e790d1a8e477ac70e7329cb344540b06841b145beac9779a097a24e04f0fed338a542b446e5a787e1e46674901d1cc1c2ad125369e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bb3c9a7fba285aea4a003824e184e54
SHA19ca520d3d8beea4a0f3176b7185203d97fd90651
SHA256fc40acad2918cf4ac44e55e990e227c829485ffd93b7012a8a620b1e4bb7c3b7
SHA512b8a541f25f031409dd144c2020b8b5bd202b93053eded7527d05e297930c07a1d20a5614eaaa5c045d7c34df785be6458a998395d0a04a1f7f410289c0bb789e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583f0cff0b98885f8e4a62a129b5f2f8c
SHA16eac66dab55a22c6ec703c9662818c651575a58b
SHA256bd92758164ce1c5e90000df200aeef576c79d8bd70819a1e0c31cdccd004d90a
SHA5129249c2400388dc19372246e7f6fbe886cb15354807338c65650bad9a8dbeb6f204754f1f50e17d5fa28997f8d6e1c0d4626afebbaa3be4671428eebe542e87ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ba522ad128cd2e5f6a752fc12fa7f27
SHA1683b4da42f3f9a8e6619c2856677c5c2ff38e272
SHA256cb2353f6ac13d44c33d91cc37184805662d1477836b234b2e5b82c9dd41f3dae
SHA5125fbda2ac7117f097a1a84110b5e8d962f82698ea351750ceb580a039e2e39ee63aa2efceeeaf163f402a2758b0dfb1f1e47c2065d00cfa6b8d2e2dc657e320cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5593b4fd933b6607071e8fb517e34d1d6
SHA1920275ad02b5f18070e0849b429f814509fc4eb5
SHA25670d178e0305def41f7357b2c12df952b4a93af71a1c9b401956e27486508c6fa
SHA51283e99dee6a78ab7eb6838c9b570d6b37c71f67cfebb62beb5ce7b94b8e3a6cea5983375a0dbba7b99eddc4c43e1af7f90cffdfebc55f6161037747d099d01859
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545e180380f138a0e8f95f42637a32313
SHA13e00f3532efbbfde2aff9e873268a7b448097d4a
SHA256439e408040cddf2e4d7ce6746af21f022a880b1d7081013387b3f07a74c368a7
SHA512acb67a018cea90154cbedf0e1eacdeaa0e0f638f063ba85df7902b9fe43937c5504c6133469ccad79a59eacd1700098509771e53c2b5589c941b1d84e7871965
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a377ef7e3437ded85df772be4a0d40e9
SHA11e177a36666d49fd8560d082c7b503ae61b60ff4
SHA25651a661a173c360669dcc7b46fa93bd7b655837c8ce2a86f6ac9df35956007437
SHA5127db194d773ea5f813003819fd6edcab5fb4e6546e51df907d03ea7cb6f3ffae783f3d2717c61df93f42e2ffab37baeba8338d6aa1c602927651d7c5c8a650210
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebe2d8eddd5e39fc13cddb43dc2b0b73
SHA1e01e10f50f70778c3718fd46bae76632432afaf3
SHA256c70bac2c8dab33a6ce8d31c8a543452fa41dff751f736f1f915e456a0e47d1d2
SHA512e5598bf75efacb0ad6c46aa80619c45e096d905a554c3f173c967a384caa1bce093f550a74159695a3557f53a5135e931779cf72529df5a63c3d8d5ee6522b05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f44978df6ebfd5f284829f91661d34a
SHA17eee076ad42671e264deb9da546e716c3073acae
SHA25616150fb7e40be76fac2cd177d3959256ede78e68bdf7274f42ab8be4bb361166
SHA5122ab3392ae282800e6166f2cdad743afbea373c5e7281cffdb305706f3c5af2c4fa984016e335777d38c7add7b6e2d070ee8cd0f501977002aca29462018875ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f9d13b733748550e450b6d2a9c34478
SHA168a828c40fc68ed208ee12b673a5f26fc212a7f9
SHA256aa991e93ab9f900cc018e545f7db60017308ab6f818c4a273ed2e2488d2dfc5f
SHA51200c727fd9b6901d9391e9139790586b01d961713292921ac28ee1c17c9b4c8edc069f24901ffeb1c0221a08052b4416294ae5f7ef4745da6c458acc314bfc00e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581534ddead18c40654095026a879453f
SHA16bef550f753b801424fc6d8e0307ae74a85e0e6e
SHA256442af839f38013ae7f64da7a6b972dad42bf50901ecb4e38bb13f37d18b2767d
SHA5120ec7bd46deedde3d04ee7b1d38be38bb0fdc1e0d8d04313576fa8d086e648091dc92722fcc0c306a19be85019b60550bd0317a3f3c712ff44dfc7cd4e60aa10e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5693c04f6be7be83c3635a9a498b1d11b
SHA19d82d6680097e1d71e36da8d1db4d921b272a75e
SHA256b2bd95ce55c3ffcf05d651d1ea8c5f07727d039ffc44c1581b5fb8536169cd5f
SHA5120f0080cd5c98cc793bb1854cf547f4868762ece6a5ceaefd56fe5ff43da05d468049e704b7a1d235ce47e04d6008495d8a3e949f89d421c7c3ed642046de0446
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ceed74c6ca1a7380c869d5400f7bc63e
SHA11ba1280b0f400a2b832b1087bab3a122a2bb961a
SHA256ec5308384df3c06acd27907d8e3ecae736f3b35977ff4eae78c37bf6380badf0
SHA512d3d330e7ed08f0bf1b8cb717cbdb54331d1faa4b5e6edc765773698a56b13511b81b7367470769165e69070e263ec7d7a79a2618eee9cd83e9e02283a8812712
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5f1708731ac429cdf51fb1eec79d74b
SHA12369e2795fe0edec696700798a8fa54265cdb758
SHA256f269e01c6a1d91c4b14211b275a57738b17321dd29cc5eb25ecab8bf7e58d2dc
SHA512fb3d54244ff05a7ad910490196b7b9c586900b546cff0f334dfabb163df631413f2a66f6751812b96b5d04f8bf52658410664eeeb6bc5316598df435e76fb797
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c9bf24f48847d94ff661a198d5c3174
SHA1684df6a870eef75c58f043bc0b710b43aa724f19
SHA256a8cf3fa21c7cb5d9e7c9aad6adb972b86cb00d417071b9dc5f7a935e149f0059
SHA512b9741567729e7af9fd4039bdc3b82d31cdcaa45488ed652cc61e404b9ba1c4497404c55d862bed1eebbee6cd55afdaafc84e1cfc4ac805b6dc17534952913ae7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c492d9e6efd26f9dd5e28386d8700ea
SHA11324921352772a4a42db6c67433b33473ddfb9fb
SHA256504af36496c268b591da75bfca018bd1b7f093e339338c97f2eb0e2b1f4c8fe6
SHA5126f64ad4719f2860c8627c0d6e69df4dd53d25fbec0921db9f4db6e8eec19a2f75e36bbffcb415f9ed6cc1e86ae92194d9461a700ac4623ae93fbd0ff330f9832
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5161613e0683d50e781194a61b714048c
SHA15b0f5926c3a55823f8812e3fb403ac1c3f2da8af
SHA256bee363f4c1678d1114d570a0f126d1e897bf7cd0b8d029accdf1638871600bfd
SHA5120e445beea63299428a649c5175cee62fd987a1044ad1fbcf67a71db5eb69588c35703ea32705a76d8f4960b7ea4bdbb11f6304b91eeb52a2511f916facf26879
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3f170f83e1a93accd6294efa292cec6
SHA1b0a1af5f04fed21f9179cbbb299f0b7afc22b535
SHA256df8aae23dbd96ccb2545af7f3e1196ef6d1e1b4792976b497fac9d8f1fff2011
SHA512ad016588a8d7e5ca6293037db7db5cc2df80b43994dbad37481d7db1787d5fc9e0940069e75c1bf5bf4c97bd1614e1bb4fbde629c81a24c09247f1d3e77361c1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06