Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03-02-2024 11:45
Static task
static1
Behavioral task
behavioral1
Sample
8c3ecc432bff236388f8e1ac5e4b8890.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8c3ecc432bff236388f8e1ac5e4b8890.html
Resource
win10v2004-20231215-en
General
-
Target
8c3ecc432bff236388f8e1ac5e4b8890.html
-
Size
43KB
-
MD5
8c3ecc432bff236388f8e1ac5e4b8890
-
SHA1
c244a17c4fb175493e25fd6305f6c5a36589ea21
-
SHA256
fd45534efe65bc94ebedc54e866bd728b45cb3ebf8d23076b34c302f808b8453
-
SHA512
3584eb80fe39c8b9882f3fbb1165c69ed5173f8e680a255cd44695eb54113500a2e60492566ff656375509097bccb075e8d7119c0fc54ef7ac6577185ccd1a0a
-
SSDEEP
768:KyTIdo6YHtBWxcqVYbvohACWbsT5GS5jIbpRFGsi8n4l:KyTIdo6YHtBAcqVYbvMAtbsT5GGjIbp8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C84E0341-C289-11EE-84F1-EE5B2FF970AA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413122621" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30ec9a9d9656da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000096d98d86c7288838d526d0d5c4552f13502b55cfe2d4bd0c8f426e5b2446af93000000000e800000000200002000000001f805f6dabf87958de5ed60909f67b81423172281a4ac8ba76df692b4e5f562200000003556a37c8ae031b9d5eaf6bf987d382d691cfca5d541135f202f274b9f8c91ed40000000affcb37685c213f733d66d8aa7826a7e67ea406fd5c77cf65888a51828f60b0801b4b58a369edcf49c79315e6a27c3fb88719506ef5046759e276cee682c3f8e iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000039691506699da19f34638bef8269ae713eafeb1c161eafcb7f4338005854028a000000000e80000000020000200000005784b49ad01dc71959dc1f151e2a97c3280a03a87930b7ca3bf12256acb95d889000000055a5daec8d9fd6d5629a21cee3010b9f730a52ae66f2a931bd2b9fb9324ef05194f5e5599cf301d66d6a4f7095b20d89dbd1d37742248d170a2312070b91a75f2eeabd87261a0e606528effcebffebdea2ae34ad4bbdacf502c798272f4a2c5e2574269670c87f938f339e5982aebcdc06c5c6d3ddeabe9bbd175196db59ef9c964bea3fff3991d7ad693b0e3da2b97640000000d56a70bcd9c750a52340717772a7cb5211804a1cb985e8bc9af270419260f5b7940b6ad8131bb5cfb225ceff616df579949f671bb42eb57c70e28cca288cefc3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3048 iexplore.exe 3048 iexplore.exe 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2400 3048 iexplore.exe 28 PID 3048 wrote to memory of 2400 3048 iexplore.exe 28 PID 3048 wrote to memory of 2400 3048 iexplore.exe 28 PID 3048 wrote to memory of 2400 3048 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c3ecc432bff236388f8e1ac5e4b8890.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fef7d2db6b742fe16d1194cb58b4d67d
SHA1ac9b7c0a91693fdec8c20d12a215956703bfd97a
SHA25637f2eccc597aa8ed0718e141d77a52649ba4782b2ef85fd9a02f3684bae4a89b
SHA512a29e40663d1c9a93e93b73f1a3ef509e9abdf8827e54c91e20fdf7486708fa7998e91340c8ab557472f3f8007b15f850f95a4e8000451146fba63edc01ccc80c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c7f6c5a0fb071c377007052e3f8820f
SHA1c597699f4c6be37f847b332814a03413da02f122
SHA256bc6788c87d023495e8c619f9443a898a097017604ad5574c9909fd8eb7df147a
SHA512afe4620b94a4d7ad685491958ff24e0cae2b489fcdbb438f894b8553d19684610a0e929a6778ac5659a3a2d46b841ccfff3762a33ed8a0f2d5b88058ba0e4eff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c0d64833cd01119ca6e4b648d09d021
SHA18a500b8ce37e85f92a9b104ae3c4a6a55b68ef7d
SHA2566ff524740538ed2e2fb68ad30f7854b1a7224ae7ea275dd0581783efe6029505
SHA5128ada1f32a32ae3765184248b531d1dc663d593163a180268ec28f06603f64a91664483833ff1e78cdd9fb6f9cbf2d035c943d7388a2bf103e3ea94fed5107a04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503eef15aef5242de2b08c13a792cddfb
SHA188025f09278492f1668fbd0e78e1eb721ae0ab30
SHA25631f6805269047a9f8fbbd814ba4a67cef8807925273763b96577cea1d94f41b3
SHA512fcce62aa703e0f5fbe3fd8469f46905dffaaf70da2a183f88ebf29ebc522af429d5f75707e348fc379cbdec1cdcf17682fcba80879c8615205586df3e25fbfa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593a85ddaa1451271543baeb71eedba29
SHA10ef812234defec6f641db25dc353886836334064
SHA256204ad7601afd115868e9d7c8cb8b26ba9956f547ddd6e34d1db619477c39af4a
SHA512b48cdf5d33801e2df08b16e8b9b334180f8e3fcabdbda7e40f1004cef048aceaa4a81de9bca79f6c81bb8e8f9879d2fc93dc2656eae8ed5a05c6fb7bb6995415
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585f882aa56c8d9eb7c6f68157a7fc9fc
SHA1ba5af78a60fe54a72b3ac7279e717cfc2e52b8dd
SHA2561b2c36f59fd97e492f126c6ee7b251f50384020b439951eca2cefa8dff65ca0c
SHA512bd543303e85b9de4758beec3d26225d9e4d2066faf1b5f3890e76ad99b1381c9318958a664ac9e4cf458a149ea03f818c0f3fca5527db8822ebc7e45f9634bbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593976b91b498440bdc082d484fd9433a
SHA14f38c0175f7394874ce907b4c78750c9f01e2c89
SHA256132e2803bd19bab2efc67b54afef2e058e1e0ffb6bd9bff091b6eb76cd2daa14
SHA5123530e0ac05f6e986ef45bc2238093390cd072b72e1ff1432a6c1e06d162a724b152e1815aa1081068b2ef1af125caf7d770bd57102c53b72726e7f07db0fb337
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5166d2eb7b3f98df351c6178e9baffb99
SHA1d9421e64e604bc58985392dc1a6ff6added14559
SHA2561f4d7629257223d2453a52522c74ff8d136e63e62ab7f008939fcd74ae038c50
SHA512aabd92d619cfaf3d95b578025cb45285cf6c9c47fc39d0d7e8af3841de3da5e12081ebba11ad2bb86111f5ae7639734b87559564c9cf4db529585f3ae98533b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528e763c8dc95d13a31ef7eb7d0986a05
SHA14293d1794f0444c5f5a7773135d16d6e604fe94c
SHA256888cc005268935351ae25a5d2340b404deef2039b985934c73a1d6d4c627d06e
SHA512731ededf0041c6d6686389092611060ea49d00a38f7e4abf53d4c462cdffb17db23f3ee44914ba90e97b54ef7552a57ceb47b85b89a548a48f02aa3ea4d64cf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551397486e9607d9a0f32f075f0b05382
SHA13f47bbf60abe20375eb7aa7b68bda396e2a9fd33
SHA256a4c96bce146efdcd73593963d3997f06e048dfb8e690bf23861e33ee17103a37
SHA5123ccb277d1d7a45d7263f843166085372c7084ac9969e53cf5d56823667c544fbabeac3ea64612f9fb701228c9f10acce61b1a7ae947436e346e785f3e35ad768
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5227ed2845b67b829214cc3f35e84fdd8
SHA1cebb2ec6ab1b7b638c5e1dabbca7e115f4d69589
SHA2564ed7248fde01d6cc61ca6bf789160c815a28798ad6e2a59e6a5a623830eeae5e
SHA5123f3371896e935a43b90dc654116d709daa7cb405faadfd7fb47c07d687a2156543ec2b7868638df14e821bad38e36d89bce12863c999a271b78b8af68912bc6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a9d81fde1d4da268166400f91623f4c
SHA11391c333db7549a259cdb499e34b80a63cfac8b7
SHA256e1aab4e2d5e9aed961bcb279dd4e74eb22926648c802daa9ddb337ab384ef69b
SHA51248a0f861930006b43a56d996ff2a618425b428922ff6ccc25bb470d9cae86e5ba8774a9b0919963aa8621a3e6fb19a8d65c259fa43195fee576a9a23f0fa7855
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5408e4d1564f9fc4eda24591869dbd1f1
SHA1e3ea4030c2e570f0116f5edd9b502ae01698dcbc
SHA256c96f263910b8cd826d871c5ab21f25203c6c249e02a7e0c32f0c7d77ab504eaa
SHA5123c5f67cf9ce12fe04639b38299f34baf1f374f498f08b116174a6e3cb9bbb3390d535be1a6243a663df6c2d6246d8ddcd73d9ae103bcd9b57c06ef7fd427f9fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540df8cd30e90e64d47cda0204323d720
SHA1c3042681e418a9fea43d3344ccf6c0028aa6d62b
SHA256d29ac9487617422659bafe3804350eb10eb6dfae4a04c8a95337a499f71ec78d
SHA5123ddef42f8840de8095c4b07606c375a0a4be01cbe47df7aeb2bf079156f44e9c7cc6453466fc4ee624b79405a745c138bfe7417768e384bc17bebbd21a5559f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b8d7a9a4cdc720979ce153a47f5db15
SHA184126bb4cfa8975e920f3a8eb1ffb537118beae6
SHA25646f15c87a270fc287dc85076e19b7ddc7fc78d0b7b3a6b5194c6866295e08ba5
SHA5128dc4d50c785ece32b4a7bd8caf17cb9c9beb8b332dfd1c744e11b2b7a363f7b2844b8096c73960ee82540b7787b7ba7ed0bbb300801435c06ee529eeb6a38a43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0a024fcc062b46136c19ef923ac56fe
SHA1f27c2e2e7a7903ccfd0bdad459f8a18ea40dd1bb
SHA25646f2cf1c5193400a62e0e96b7c7bdd61d939f70d081ee173083635e827be8cd5
SHA512a3f6ad8477f8383e9a8efb9a3051614bc75da48e632de9f4ba55f3b0c76b98102fd37a4df34ae289957b5d0bf7cba50f7573ed8ed398ed76277a5472b12fa6f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574aff71e710b13003f52b08c4d73bba2
SHA178cf235b34041e408b6ebe4dd413d47498b4dc49
SHA256b2b36198074715daa23cd03f6bdd812346e26bddef68b1a83afde3d7124b310a
SHA51243fe4e46b96e8118c07086a22a9f8a935af652f20517261deda963c82deafc94cdcb7420c9eccb78478379ec5dbf131c82fd3deafb8a59bb07d394f4436a536d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c95fb300dc24f444e270099cc5ebf93f
SHA1b31da91f5265213433a41ff8048cfcf64bdda453
SHA256899c9ff181fede09ff5e0da097e54c46dd7f00762cb496e13f0adda85de014fe
SHA5121d27cb791328b55c96cbdc357309cdaaa49c6f7fc23478bb5b3031bf2947822a5d1f175c164fc049327dd7d863fd6baeff96c8a580df996c2302679e7a9502ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593f4b325dd77d267deaf615ad40f3774
SHA1bb0f57771d553e8cc93a968fbd84968f94b23484
SHA25692030fffb3b3b27491135bb203317a7cd4be73e3452ecb57b895ad4b586e0a08
SHA5129adabd1b3a04e99f0bb0abe926afd6f1f3cf871ac5b841e5248083e148f635471f237d179e57e60492053c4571cd1756b34086140378293fc10e47e91de44807
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06