Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04-02-2024 04:06
Static task
static1
Behavioral task
behavioral1
Sample
8e2d37a84ece600b6fd6576b6352037f.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8e2d37a84ece600b6fd6576b6352037f.html
Resource
win10v2004-20231215-en
General
-
Target
8e2d37a84ece600b6fd6576b6352037f.html
-
Size
6KB
-
MD5
8e2d37a84ece600b6fd6576b6352037f
-
SHA1
465e5af80d951900dd8ec0605fa3400c4d8b6566
-
SHA256
960b8aa5c9c357101800ec439f13257dd5f0a8979222b6c802566ce6df296175
-
SHA512
ec127ae88782e609121dd3afc2f71915d395f65ffb3e9cdff5df66fc211f3da47bad1c0d1649d8517045da7870ff25c1522aefbbe760cf9a49ac551ed59db13d
-
SSDEEP
192:Zy/O8yw4RlDEvHLgszgA73ydXDChxiqEuf:8/O8yXRiLgszgA739iqEuf
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000740f48479436b0c0ff8d2640303bc743f94752dbdd20bd86ad01f02c1dcafc62000000000e800000000200002000000000fd1f2ca19fbdbf39cd677c0c3b83a93b5362fe572c68a6383a98abba1854192000000078be11a96d96e03cff9a8902048e9a3563eca8ecb56b96ce268d30fd3f3a5025400000002f93fdbfd2b0107512a94d6dac4fae5e382101e33679840bb35e84829c5aa5eaed6299dc1a7e7b5c7b4ee08bc231d0ade4aa614b4fd533758477d7cc4f7f8b94 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04f14951f57da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413181447" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C097D661-C312-11EE-88A2-EEC5CD00071E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000f8fdae6afb50389146e40008d81915963494a66d00b10466e49c0a4e6c04b826000000000e800000000200002000000029563716c0cfefcf7e9bb88f481085cf76aa545ef52da8641082faa0d8db8543900000008c79f99b82392e412366dcd1fb906cb2d303b8c611187139ae5f751df4c58975322743b523f01befdf38f68b5fdfd0557631abca3f170cc2c76e9a1fc387177da77f9fad93e47c55c025505a75f82a158e39c6404975c084f1cce1c3f1b7da67d3019da2d1a12e39eba3c540f83d109b628a4dee61e4992c43fd099e376b1c75772f05abea71d8f392ec38ea7978e585400000009a52ddb3b31fc753cdf5220c25a22e83cfff1b0eec563acaf7013ec31dc0a6d724d745cf9e6bfeda306144d3bbdcdb572585e32d73f5b72cf6cc0aca202eb606 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2060 iexplore.exe 2060 iexplore.exe 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE 2208 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2208 2060 iexplore.exe 18 PID 2060 wrote to memory of 2208 2060 iexplore.exe 18 PID 2060 wrote to memory of 2208 2060 iexplore.exe 18 PID 2060 wrote to memory of 2208 2060 iexplore.exe 18
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8e2d37a84ece600b6fd6576b6352037f.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580be0d72ae5bb91fc770c36544110a3d
SHA1af7a2eb69267f13fc6736043d65bbb0db2a34050
SHA256dee376bc0c03e4c1eb97bb439e03c97f0324cc235d0bac60c397df796f352039
SHA512fb49e2607f55188eebababd86ac75f5bdfa12f118cd99d225550c31e5615f9f2acede6dbd39121ac8aa664333fe5e2641832f887f9445ef94f442e753b87a124
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6c6054c14475e1ddaa004e8059b44e4
SHA18f8425437a4898d0cbab1b6de20a26bffa3d7ce3
SHA256d6f968bbd71180ef844a5a21e9fde7ffba44c6303cb112485bf64132d617f726
SHA512547511726e68cba756b27c7bf5c8af395c081db1f0cac5c5f3800c754fad27de97660ec5848b0da50eed862ab748de2d7cbbafe479a8ab42e33d851d7c414002
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5393f8b5744ae13b5d6f49cb034b3e389
SHA1b66fc4169051e48e0804018eb17e4647f361f778
SHA256f3249e8ca1ef18c6eb5a5d29430126e06cfb2d6001c40438e6f8e4319ebc8fa4
SHA5123cc284ebb34f060be48ffa5e198f32d05bfcdeaa90c109121d6c783bb30b64d8c489e435ddec0651e556c7053bb30c810497e56c3ca741fe2da0e4b7e7fdd209
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a25d9c387b9e4a95357626b9521ba695
SHA1942cfd0fc6c93430f8bd85ed8c36830abb260e52
SHA2560e3833ef59750ca2e3b63ef55fa27b1c60b3342614fd5b044a893e7f8186a135
SHA51223dd26eefc89d40552512f09b97634d3ca37565ab0794eb7453dc94d6426620220f28df1cff57de43e2cc824f1711776f0a546a50670f4c99da8172e75cdbb52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6cc4ff2218ef10f75f31faab0d2f86b
SHA117a094e8cc3f2d1a08678e3d19314ef1ff826f21
SHA2568a53e389cd8e376e53005da0a67aeace42bf78c4c8aade0eef1d02c31f2070ef
SHA512d5ec832cb541392616fb1fd0e58dffc732bbf6109b906911f857c9dbb67135cb1d846533077321d5334be45a5ca510b880144517983abe15d35c416902f4d1af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b655af1d54a2b26a57bc1a5862c65d89
SHA184ff06224662ddbab7f80138181f4280c21b3e90
SHA256a2be649b98cad1a5a0f47c07a19f3e482e44fd0b76fe475b997e8d0898d48e4c
SHA512d9ef6de0c8a819d403bb5de93feac1caf015d2ef427ba4ffa4d12ec9dbc6e47768cf1bd485f0fb0b37cf79d6f313fe85860a2e1e6202aed5f3316d4189cdaa83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52513d8fe2b31a8d4b6612788aa8d78d0
SHA1410ea989ab3316aad6c225f123fd43f4d24a745e
SHA256002b9c3dd6a7111fe5a904b727563db284d661583751870d5c5c3989aba03ba9
SHA512c2added768632f572299e7c11f32782f837732599eb2c7565b24221511e96cbb0f3e63b89ed82ed232a1484f95ff880df0c559dfdb8707783cb47674b0d35a09
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f25f8bf0bc03d9f21e2ca87c031120d4
SHA12cc911a6a87cd68267321fb97ec6123e5c76ef5a
SHA256d1e8ab2cb0c2a8c8cf6be3fea3edb76e46b706ae8053d52010b374f859972dc8
SHA5125147ba101dbaaa82749c156d2620b4cf4dc407b04b2fb59496665625512bfe1b31f216eec0b53056efc55d17193f166c1eb6f76787c349b49dbd8d59e2218d72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5120bde15b3119fbe5b428cb3343f1116
SHA145dbfa67cdf271b91b8dbcf991bb7a2070624557
SHA25628787c26dc1479bf38a3538257f50b49542fb5558a49ca2273541f2f08a6a8ee
SHA512e25e660d4d7a604e25b1120f2ca2f7800eff8017e111fa86f111d97e4d326ed476faff224fcec8930a5727ca714fb40015b72dfe2b56acd850f1e29dd86e76cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581f6f06f6d891e298879e43b3d4474de
SHA166535da59a4938e2855fe9dba580b0ebb8db3fdf
SHA2565f0e2e3e050da87b50955d2787fdd3d2097343816d90a4f3154bf967c9dd4a3d
SHA512d7bd77f6daedcce1e84214ed780863a61b096481a19c1fc99f8be543217f8905ed7ffdfe0fd89ef77fe2f8b8e590a6ef47e2fb6c68fbc489fadf299b669af10b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5636448cdf187b82949e8d1b6dc123504
SHA11b1089faea58da8afb625b119f922a6c4e46e320
SHA256ad5d02b4046595965e6090a0be99ca20dd73271512a00b0a889f3ebfebb315d4
SHA512df86ff961b523fdd474c2c67903f82aebe9d98d5c5ed3b2cc7d814360af31d5518fd923576cfc64a6e21fe4aef179e60c273613137d006119d4417adb316085d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ab90a04041c3133cd117cad39525900
SHA161c2b8651685c001abee485d2b51a77889705cee
SHA25681a425f650b43fc8d72c1acdbf4caf8f70ce4df2b25deec519049f932bda7956
SHA5128a3f8bfe3bcbccca96ef988aaa43b6e98b53eb06172ffe47d3628295044321fc8f2076c3ec0e99c2de0de121dabb78b73fa9d5b855c84263ac682a3aae39ce43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecc0078c453b740dba8695b5c56ffdcf
SHA132cb587fc72604992c0206d1bd9637b289548474
SHA2565c8d34c6a856f756af902a48aeab3e066cf216b7f71b9239ecfc783af59e47ce
SHA512aa5b46387ffe92bf7b399d23273b551472c4fc116b51d27f413529457b4da9537f95bb3d797e5c9732e78c3ceb61285c35a19b91eec07e66658fe32f5ea51443
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abc694322c449bdb9185ceca1eec3bf2
SHA1741f74d1eab58dd1e231ab5e6045860787489930
SHA256880ab90dc73bcd6375862f1e3afd673726a831fc4ba7424a3c74a517f69e10ac
SHA512c0bb8b988b5d3147ba9bfe9289b75f51375e00437f2876235803ff645522594b883ac82bc6f157128e8ed8d09295bbb6a2901c21a0f96cc482f6d701eca9572b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d875cff6af7e8f956eb57ab1d8466ae
SHA1fe100a919a35cac6b35ecf33cb69f671238ef1f3
SHA2563f54b998abf57deb66be6f19519e0747593a5931788742421c5edd6ef0455993
SHA5125f1ff59207891f5b56bf4ce79e3c4a43ab6ade0aed7cb4373693d8b160ce55818ee59615aea7459f6455fb6f5368249e3594348871119a2ed175d7fa5edcf35f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff9841d4c5e157161c384e2496de5163
SHA12ca5eba38a415a299bd57af5235f3d9336fe9924
SHA25646317826fd560b80ca39eaff0d11d6875d4c84a22bb39e9594937db999817d86
SHA51222d8b7d35f4c71414a682b56997eaf055f1cad1baca42106fe080b86c65df1ff3f4443ecf1e55be0475c99f75af2949903076237db8e03e317551fa26cb86cc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587d8d09e169ff3a6305b2631c86270da
SHA10e6d71be6b06225302734566a73e589af8b229c6
SHA25656b31ca3e2fd8d851440822cea18723da9bdde44152b37baea5bdffb06fab689
SHA512f03520af5fc986714d8bfb4ee61771f1deec2de4cb58cd5f584282beb9b5b1dfc7cc9bfce261977cc5c37666395a8f3ef2d3d27e1a2d16095563c3fad31a1646
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5118fb6ec3e0ffe61711f408841604937
SHA195e33814683fba6293982e83bfa603b47bf2f7ad
SHA256e1c8dea9f01409fac5c54a7c897f0899363e7cde400e1ab94687bd2e9f5aac03
SHA512f6efe6f0f65fe243356c135f0f65d95c6eeebaf372e8f024ae922f5d81c0dc7d3f1ede825b644ede02400f42b3060192bc6794d8660b9431f1fcddbc35a4936e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ab468e21569f8f4c8602e3350ec2488
SHA14d57b9ce491305885a525ba20ff2a4999044b11c
SHA25639b92b1cbf59d231b1dc07a42437220f8da937c4e7f32191aa07e8292e9693fa
SHA512db54dd7d5ac3c58c4a3edcf37962184d77213eb188a535025c8c45f90b5854c26d886f390b9b9175049a157d3caa7f2e7c7d7af58cff844942bcff20f3a17c8b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06