Analysis
-
max time kernel
120s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03-02-2024 11:53
Static task
static1
Behavioral task
behavioral1
Sample
8c41ac05616b79ff5b65a50e3fef86b5.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8c41ac05616b79ff5b65a50e3fef86b5.html
Resource
win10v2004-20231215-en
General
-
Target
8c41ac05616b79ff5b65a50e3fef86b5.html
-
Size
110KB
-
MD5
8c41ac05616b79ff5b65a50e3fef86b5
-
SHA1
3a650ad296549cdedf3461ce5f6fc24749b7a08c
-
SHA256
afde33ac38ddaa33097eb4fa1da2d7e135ef8d6ea85c2091755e6d76f4789e3a
-
SHA512
a9e09f8ef0d68e2c6a79851a5c4ea5515856ee2d5bc10043183af70eec6fb74d4a0e9887d4ba5e7d063632f05ead003d960cc4a988624713668bdb41b40701ad
-
SSDEEP
768:p497dQHovsAFBAXKfQW0zTrw00GRTSyXaO2/DeVCclIG2uErCWW9EAhrs:p4t/BAXTG/Idn2uErYOYs
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0ac72b69756da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E145D6B1-C28A-11EE-88BA-CA8D9A91D956} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413123092" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000006b98370e1de2d672a9b0c3e95a50adb35be29529a834de2c8eec8a0013ad971b000000000e800000000200002000000061329ed5c833decc837af9dc74b41553542529b96d225841ce5cf2a6e2e68539200000000d6031c2817435c53fd3c4600c055f86170365fd84edd4af8c29cf3566b6f20840000000281e600db46d958d554a9d3bbe1a2ff74d51dae310301bb31beaab198a9f8f6e3c9aeb342aabae85b33a3058ac059247991c36dfb3f73824e6a3c7e94f5ce07b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000089d551fe84ee68c2cbe944fd00125e8540815055ecae08d8ae6dd39d7d4bb77c000000000e80000000020000200000009706c1f17371c347992fb32c331c488cc49c52e873ebd19e682d2844178e56c09000000071435b3c6bb4373e1bb3f3ea9ed3da33babfdf34f628e28e249ac81f650d0cc8d84c59f63bb6a7918d5890f435e536e1c9af8f2ab946dbe77307ca0e46cd75799a35edb35d38c281f346a58a43a3cd673a8abb288a00293c2d6088cc4f33b5010075c49d3689212064dd14ed800493b848f17e3ff871a1725708deafe2f5ca5d5716652c6b4226572d5ee24dca458327400000003d6b7595e922fcb83da3186450df1f3d4ca258e70f0456e7713e6bb0c354bf4fde6e59c6cc6ee3a0e8c57e75a8c603af3b7ed69275170f9c71b7a80c80e3c0d0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2544 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2544 iexplore.exe 2544 iexplore.exe 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE 2860 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2544 wrote to memory of 2860 2544 iexplore.exe 28 PID 2544 wrote to memory of 2860 2544 iexplore.exe 28 PID 2544 wrote to memory of 2860 2544 iexplore.exe 28 PID 2544 wrote to memory of 2860 2544 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c41ac05616b79ff5b65a50e3fef86b5.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2860
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f12fa138976a4d8358c1a7d58fe0fedc
SHA1cf20dbd0e559268b95b806d4bd2cc7b4ffea984d
SHA2567a72feb5e73a225a7e903e7be097e16b43c7813ff29a1bd1e05c05bffba75291
SHA51292c8c070b83f5eba9f23e4e1a74d973864b4f72ff6a34621d2d6437b5290724cc9c1b5e6c8e4c399e31be7ea436d640ed78cc0544655fa318371a8145e992887
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b06f0a57a04b5538fa78e879d79d702
SHA154faad370dc3e6cf6788279fbeb914f0502a3976
SHA2568be045cd9b36c2ee452745ff56cbdb4c327631411a36596b708144617ad84d87
SHA51287b66f37711e71c4211fcfa0c5d11918d878d66cf7a30c8853ff0dca0a04324deccd563e2c122b097dc8d45bc71ce6eda31c583efc2aad8daf3c15d3a9a38a40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536c18af3a7998abf1497c3acae0daf48
SHA174315f9d660889221b1437b577fdfdc440137d49
SHA256a09473a300d7bb4b0b37f4d90640c56dcdbf8931242c549609a30df2e7ae0ab5
SHA512baa835ff18b74953539437a0ad8e3d4b13f8f944acb7d8528ce3864543642f00f625bdc2ff8a378cc960ef2254e938692b8947541f3b791f6bd9092ecff20782
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae1ecd46b7676294ae2dfbec661d91f8
SHA1b6dd2747c584d68728004da989d34e7925276b92
SHA256fa0904f465aab063cbf049c0d91ac7dac8065947233d38bb74d07db08e644c8a
SHA512601db8eecff7ac52dad79773467273261331436df6f12e4eda46ef81a991080b2f36618ab243d10edfe0569d2bd0fef1480ffaca39c49650467d2da7296fa4f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5029eb9a3f7da631e82c664dcd358e5d3
SHA18f31781ce9a2cbf77dacdb6c393cfd9ea3bb5bcf
SHA256ca57eb26685cbfff1057ce114b80d1a721172409203c56c7fc3dfd0170802cc3
SHA5128f5d84a6db886a6671de78714d8d8339908677c2ac9262e43bcbff69c3fedc6ead280be832e8176bb7197b7f468d5fa13a62f1c20174977db29f6b3ea0a82811
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500700974cea640f1636cad31631efa6a
SHA1b8a266298da49ddbc5ebde49e54fc98c810760d8
SHA256be703e5653f58e8e9b3ae6f678f3fa1b134d1e1e36952a3847b6ffa1924b0050
SHA5129961feb85a3e5b8cdbbf3584d45a2ac56b46e9bd726ee3505ffa0c014c9cc56ea6d32d5aeee5ce1f4cb18864e924da0f6eb66c4be76f042a78ada3b381754f0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e618986561fe70df6173d661c86744e
SHA1cfb2e3691dd8f34f9e18db6b1ac5f4df11eaca5d
SHA2560b6df206c59cff5f837291ce149cd10a0dddbf6f23000741c48c4b04b11ee367
SHA512adf0663b5b7ffa925c5a99c7ad0674ac107a770d40cf67b1b19d5ebb92f1b12ae1212813ce6586a08b58c38949160f244cffcca7a047a8103d74d11f7830b098
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cbe058f6d27759db66371add290648bb
SHA117adfda683849380ea2b5cc8bf1e604b1c74ed05
SHA256f2b1df0c44d68fec8d43ee837cc81a4d37fc88db7bf6d8ab337e608e5b0ef530
SHA512b542cb9db9761d6752ca7792c321c781baa13f8a791776b1692e3af7f1ac02191915cf36483fe89cf1123394afd8296a151315115f60ec98badd59b3188b98bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a74f51afb6cc78ab1526e7755e87944c
SHA1c2c727c61fd8779f97cc67ad8ef1069b55027f7f
SHA256ce46d3d4d14fe57314065c67b7a4c81b3111e0b82531c830b2db1ccaee0df850
SHA512e2e9eaf17ca2a532ba848963a7f63313f0accf296a201609e958497055ad1238efd9e90d9433b830b86d7b30b45e7dd734135d60d603d785e64bdc0e58aead09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bf181b5af99763cfb16b5be8477d63b
SHA1fb1032fe5c4070c2a7d5d451d2e1e5a33e488420
SHA256643387a513692e9d9b42faecf714c88aa08d0319247c121bbc6af288574b2843
SHA51264fd98a5c9a1e86597a4a02987fdbe2844b8a40d1f389a79d36210d0d2f233bb348031de94e272c59069beec9a202a46b12deaea9eb036241502bbec2e7b3d8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51afc869078f04e8b4fcfc6a4763b6445
SHA1c6ca4ab63defdf6d51c2b454b2a07c3b7cfc0008
SHA2561fd3f1611161f94f9e7af826d779c397a79cf5fc21c1ab1e01b72db7c1f865e9
SHA5120b13f03988b70b3b2303ea6f482092e18ab1b7f6e2c5a52ae2b26dfd3c431fe739bd0a9d953e2702b4fec18c8084c3dbc03a5f1ca8415866bbb4c82320f3f441
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b10e42d0c4500a99114d462df6af8ca4
SHA194f708b516574f46b381257e7d0aac23a3cdda44
SHA256123c4b9aa0c528646150c461fff7ccaa20ee7b43e460203fd359d987b39284ea
SHA512d7e8a31c51b75601da1b9c7e31f052a6d5f2336b9eb5e17c8ac5cff6798c0c515eb6b22715385d23d16c0813cc2939c522131406e86f58cdfb4a92e8d5f64037
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585526fc7ac3fe68afcfda6e517d120c2
SHA126168b0ac6733b2a6bd594cc72cbfe2e756394e7
SHA256ceb28ecdb03763fbb0b8c815abbc729c72005a09f7269f48247339aa566de23b
SHA5124a3cda70d837ecbd9bcb9bd9af8bc26256b71c75984759730dbd0228feb450c663ab2bead398a044b84ffe39d40c6978551913bcb98a025b0376a401aa16e451
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56da2e005b5b3fbeddf3a6f03950f98b9
SHA1ab1513a2b5dd14b737a67c295684d8804e713cc6
SHA256c987627e61f4e407584e9a8f4acb4853bafcf7c54795a89b2161c380af82fe12
SHA512a0d0098b0fc29608debd7bc4fc88ce48e6e33a4c18fb5fa05a0ddb9e986a144246e7e4e0ea5e4afbe9c69b68e077b051209580640c9937e81f15978ecb38e9a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5595638a9ebe07a0704f0a10f987b3407
SHA14ee91679370d07febaafad37973c53249d73655f
SHA2565ae94407763553ba33c7c95c8544ff55e3ee7e35a4e31cc2132b6ffd60a11a14
SHA512d00af46872b5cf26010b9e3c03226de1ac26c505e5e13cdc8b1d41ba882a424204532a4d4a6e10780f5c319fccbbda56ce76e379fff23432d7bf1f41c2565140
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c21181167018abb664c46719d5f7da9
SHA15b9d60488f781d55ddc38d9a941911576da34b6b
SHA2560adc72a2054e79cb18f6c709ee52d3238c7ee832cea97d21177b212838188ab6
SHA5122f0ccdae91c3c0cb0d724d101c93b59dfeac217d7a8c99ed5fd7f6263445d88d3f474ed3a62246202a9b0a4b3fb7f31838a3224cc4fe8389f6d301f9e8fd29d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5c5ddc3ec1b4684c92e1c30223ce30f
SHA1fd2482617d8f083b6cad14a54937af0ad15604f8
SHA25628435af1c045b8bcd754199767934f08b0e29c6aa4d901b2f2a709182fc777dc
SHA5121bd70be419383764808f05ceabdf12d7a0465c00364693d136e3a0dd0f0d9c85c6036c97083c49fc6dc9734c2f991e84479dc75fe134d88263368e3834bf227d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513d72edf6265597e3f0ab3dde77bb6bb
SHA1ff436ad7bcd45eef1935146686c6308bc2d980e3
SHA256725950fcb1a9f9cddd9404a4b098882263e0f6eae4981e8d6c175a1869ea4f4d
SHA512409c529fda785609f185ada139e261bf229bb700aad19b476dadb339fd4abe3f14744e4729cd543f8450f0dc73fe541fc0468ec531df6638868ea1f64bd4205c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06