Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 18:12
Static task
static1
Behavioral task
behavioral1
Sample
8fd198987f2befc1e69ed4d5507aebbc.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8fd198987f2befc1e69ed4d5507aebbc.html
Resource
win10v2004-20231215-en
General
-
Target
8fd198987f2befc1e69ed4d5507aebbc.html
-
Size
106KB
-
MD5
8fd198987f2befc1e69ed4d5507aebbc
-
SHA1
60be1eb7e0c9a7947ffa86e2469a5176d4e01328
-
SHA256
55102bf42abd5fe0e4a1ed8225cfb8e8e999b009e371bca7ece16aa3e2e7c136
-
SHA512
08dc1fe0d03b929fa9b7c290c658cdfdfeb8f19054a071fdbe61534bbd1f4eb23e7e416adb83df249d74a2c50cdadc667fa2852119fc0e814dd24465238c1db7
-
SSDEEP
3072:BjVJj8YeO4aWrkGE7+5/tnP7+l/tnuGEbJhvdboqEN:BjVJj8YeO4aWrkt7+5/tnP7+l/tnuGqM
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31086485" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{07F1AD9B-C389-11EE-9BE3-72AE6231743A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31086485" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413835356" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3697412435" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31086485" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3697412435" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3709131885" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4312 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4312 iexplore.exe 4312 iexplore.exe 4260 IEXPLORE.EXE 4260 IEXPLORE.EXE 4260 IEXPLORE.EXE 4260 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4312 wrote to memory of 4260 4312 iexplore.exe 84 PID 4312 wrote to memory of 4260 4312 iexplore.exe 84 PID 4312 wrote to memory of 4260 4312 iexplore.exe 84
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8fd198987f2befc1e69ed4d5507aebbc.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4312 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD57bde92ff965b73dc76190e608c2fbb93
SHA195547789d183bbf9ea20ef6ba4c6b2f0249fb30d
SHA256821420f187b512f853c8b73d9439e940e6e04c499532561343a739717a9a76ee
SHA51221406b04613e8be9f2036f5057d6d3de568ec1aa4eb6471cd457e70e6ddadfc3b988d5f4c2d316e548b21b2850944a78d75a44ec3bf929e71fe61fb6b0de4ec6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD57343e35c618fdde11ba9ef903708dbdc
SHA1b8c18097eaa70db6d1507f81bc028bb3a9b090c0
SHA25642b8eac07cba772b9e4f7b201832e0171011b066c82ef35700a4372a06d4ef9c
SHA512290da13b3671c38c8de7093fd8d891a00759814cd566d5a64b2d24961db18afd7d97862f8e297c9483f67778d5bdd30a4e4567bf198dcdb5a6e4f5b7681f84f6
-
Filesize
4KB
MD5d65ec06f21c379c87040b83cc1abac6b
SHA1208d0a0bb775661758394be7e4afb18357e46c8b
SHA256a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f
SHA5128a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e
-
Filesize
2KB
MD5beae9a9078cc3e0edf38e71a8f1be9ec
SHA1273ba339be0544351e4737f49c002abe5ae0147d
SHA25698dc0129110a40d076932377a78b9a67b7a4adc909feefceebdc12840be3359f
SHA512ed24f74e2f271280a30d9a3928d1f6cd93826c182dd0f50f5901ee7f214d5a143134e840314f78e9df46c071acc9da6a2b94a51b43a9fb2c1f2f4f9f3c7e43dc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BUOTXRX9\pop-panel-script-for-multijob-site-pid235689[1].htm
Filesize28KB
MD5d8bd2a47a380ee031c5a1a0bd4001f9b
SHA1b1b3f5925f2cf6c4a65cbd7f29dc36d4b541935d
SHA2564b248a99f14e822f4b40824373dabae51592c7e4fa9b73d29eb5f5d8fd88d5f0
SHA51235cb8d98606d5649578c25a13d587664d3ed9477624ccc7948011350930e0641ba40b6aa922e2183b9aad017fe1515942cb1ff06a5afa1a6df94ffd4fdeed10a
-
Filesize
44KB
MD572b0a069a3aaed9d66f47238ad1926a0
SHA1fcb835274dba2239e4487a53aab6c4a156006fa8
SHA256f3674b3e9d54080491315b781feebbec45e4674d341deb6f8732e17f855014e9
SHA512664ee79210b14ee3c6031a86dff1da844188e32863f1353284300c0987a8eb4f05b7221b398da3f08d85b0f8f2af676e59ba5ebbf8065252e7a59c77f34d7221
-
Filesize
5KB
MD5e7a5e2d2a69e98d38724f434444a2d05
SHA1759e8682aeee5682459331d77ff1fa7837aa6270
SHA256089dde2cdb6386d4e90d721e1559c0b233acc1c5828c4eaaeb316e465d21a911
SHA51202f7a43c98ead9c167179f5ef20298d520a2aa7a5be11c975d631215e8183c3dbf3ba5863fc3a2d9f85dc9cf55987b6f8e15e345f9211159ac995f88590a2368
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FRK3R5YS\calculatorperfectmod5encoded[1].js
Filesize10KB
MD5ab146592deba8ef9a5a9e3ce9a178ba1
SHA190e7db1690a8af2eba37f3fef57a0824eba600fd
SHA2567218b9001ce54855d30e53442c2f8d8e9f43690dd58676ee1575e5f5a8259a82
SHA512d41ed8cccd258a6040d28ac7605e0a98030da5c5de971476d0da195ba81eee6604b72a3022c3899d4fda5a3d9cc76dda598896db1d65d1f1b9cb2dd152231507
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FRK3R5YS\calculatorpernotencodedmod5[1].js
Filesize20KB
MD5c4987894c9a05004950ce1ef3dd4850d
SHA1805651b029410c9510434b6c9046ba08ea2800ec
SHA256e20f21e8ce9c984bce9ed126aaafcdfe6560e3a9a321663e857943160540b1d0
SHA5125afccad9daad1efe13c37f1b9c2c14f5481dc4f6aee7ac0005647d2e9705eba6c109f98c4418f90e0abbc0af13c4493ea0b007983205144764eff25404f21612
-
Filesize
12KB
MD586013e1c0976ed4575bf072f1ed70f82
SHA1144af5d06d5a6e62adedd78a965adba0ff6d7ccf
SHA256c4420612708e3da1682ec026981fe6b0a2dedc94eb80cbf7f60ac05010930315
SHA512a261da9477eea0129074f6c86acdd4df2f51e5f56a5f6857cb0541ee662e176f61c23237557da917d42f8fdda9be4a466d413c085f953231d50ed32fd8e4a8b5
-
Filesize
1KB
MD5f0d32c937ac30fc64399d611412e1bd9
SHA1ec0733fad2c52bee2b5ff8b42f93432790492d42
SHA256a719efd2104e000d3b8216c56104774f63f87c4947847f74aaa276efd013250c
SHA512f4ccd43af5384052758c8ada5c3b9ed74080866565059d8dec831aff60c7d27dde9afaaf58cd3d8aafdbdc7db82291bb7757730ce6a5b985155c308eaa54af7b
-
Filesize
1KB
MD5eff7ffd351a0f968d74296e5a3e0bd6c
SHA1f369f0abdfade012552191a9f3b7b016d80c111d
SHA25689a0588240f17c54478ebbc947f24267e4b918c04598325d0b42ffcd7c8bf68c
SHA5126fb13146f5446677431a38ba3293c3bf34ef0c8996aaeec59ca72a80c1b134c1e436e605c98ae1f33db8a2d7388b2543542fbdac3bed5f3795c3dd86f6042667
-
Filesize
11KB
MD59234071287e637f85d721463c488704c
SHA1cca09b1e0fba38ba29d3972ed8dcecefdef8c152
SHA25665cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649
SHA51287d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384
-
Filesize
411B
MD50130cd6af5c3da110d19e7916f69cc4e
SHA15c4966c3aba1b2d582de8eb9bda33c0cc1f8bf5e
SHA256aa8f5ad198acda4f0a5226ec1e2214d645077b0afabae18b8348f509b1d4450c
SHA51202383aa80191ee6dfa41cdbee77bcde5719a5f14043ae1756df6764dc95ca89bb16647c47f650707ee66a7fa1327023b2fff58a0168c4ca25751d00e54d9e3fa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J6M39GIU\iframesenderipnumberrequest[1].js
Filesize21KB
MD5de4d2600013deb4d94ded6f13cc7ab8e
SHA1ed499cb0d755f8eee2424a48b59df3ded7228e7e
SHA256db853e781d637f7c2a805cf8c07eebc7e52a58efc42c1eaec1164f9c95cac27f
SHA5128b8f3739544156777cf8d319c7600aaaf85cad956f95592e4767512ab7acb4398eb08b6246cfb25c1347f055e53cacefeeb5faa7ea225a230791f13bb06e3114
-
Filesize
236B
MD5b69349813aad88df51f8eb8a49b078de
SHA1c79dfdd9cad764c48eb1d7ec3e8bfd6931ab27ba
SHA25606de491b7a092ef53277331634ae40c6fe64793c53a603fb5a1cb8b811c15e00
SHA512fb2971fa4f470fcf5367291bc2d130acbd4f461267218361fccf8d9a56786bbaf526194114e3fe749476c8540e65e706c634bf426ea001493e77f6036a7436aa
-
Filesize
55KB
MD5e452caa2700affbd796a4a168c12fdba
SHA136d2f754db8b0d0061a4ee85d6c5abb5ca11b7e1
SHA256ccbc0cebc181970fbf9493bfa695327f486f177de32f00313b3015666630102b
SHA512e65a6dcbec056af4fe017691435732341ec70549d0d3deb6ad4605a2ab19c95788e83ef94fe6a0229b98b99d85e3bfcaaea75654e64ce8c245976f9b832d272d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J6M39GIU\multijobunderlinkaltandtitlestyletip[1].js
Filesize2KB
MD58298456080be54ef57c5ba1d6ddd2f9f
SHA11beec4172f4c1ff54129a4a0c23032e08dca2eb2
SHA25639f7a144d81c746eff74b6e36318d06da91f0e5846b87e1579857922848034eb
SHA51241533fc058c6e302fb194f3eabcd647f54a7f587ca6537a0b71dd1154cf52eafd8796d5e24850900626255629c2ff34ec415b7681cd57f999523255815de5ae0
-
Filesize
3KB
MD531ed93bb0a346c1b09c6bfd97accb1e5
SHA1284fa3bd71e978eb2d4551387d269f9086bcafb9
SHA25620422bc978ca92890c71013462f8c96fb1dded0a3af8525676acd8d942af17bb
SHA51211034592edb7166075b37a38168f63ba6b98f723dcd144684796315c12f7ca9aa9e820cf189ed61254736767d56e27cc076b839f454a2614fda35946e5cc3bbd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J6M39GIU\sendipiniframetootherssource[1].js
Filesize298B
MD5df4a3fad800703d4018cecdfcf0cb61f
SHA1f1335bc4391fb0fd89cd3bcdfe0fe252889e1ad0
SHA2561e3ca1b8f68c1bb118bba7e088aae10b752273294bb9d53e04a7899e9a540f31
SHA5123f2ef94f69fc0a9aae34628ed0f708cb74b7fbe2543e947e1b50781cf455a92d2eb442e8ed36abdca0b4454f44099d1169208a1c8d076f2532a50890f0cd7624
-
Filesize
353B
MD50417667ab3855c62be88b5af02f9d137
SHA188aff0812f11c74941734aad8c5f4348c13d0935
SHA25684c9aeaf8f7ab5e5e2263fa9e90b1f6e7ccda4dfa4a778c7f87102577245990f
SHA5126c211bc02941480bd57fb92e384e4f0283afc9c43163a071f37d58766d8da50ffb86018aaf665c171579a4442b75d772526eb50bbd025a176846c7265ca9b54a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K44LV95Q\irmoviedl-banner-relation-to-othes-pid2232256[1].htm
Filesize242B
MD54f46b2784fdeb0b8df08b6529adeb7d3
SHA184b285d5553bc708be6405c145e275b31ee615bf
SHA2564486bf20efcbb524f243c4aa9d149750043f8cd925f5b52352622692931bc45c
SHA512b5c2fe14e9db0e641df249363a1bb6fd6da1f6046a7a8153d909889307548d44a6cd5d0b7cc9d3f698a320c724154760a7e44cd0ebea36e1d528ff351b181b4e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\K44LV95Q\popcontrolofmultijobjsmodel1[1].js
Filesize2KB
MD556727985cb20df7d558f5b6f2006c1cd
SHA181693e9bfb609325f6d203ed4c92851f28133e1c
SHA256b15cd3f4980c6c156d7883c4630666d14670989b5b98cfa850057887d6bb3fcc
SHA5125350fd58ea6c7cddd38f29365438a5e76f096cfc324b0685fe9df2c919d8366fc3d94653df58c2911e720aab51bc5c58a2fb78751579b2477ece2fc934e6446e
-
Filesize
2KB
MD589be587009b55097a4d4187f7224bfd3
SHA1e9a859a0113305fb38008cc0bd660cba2cf80fac
SHA256c10114f28ca104f1da8bd78083af97c731fdd3d49b9c062eb6f9d4430d5c5596
SHA51226170899882c202709773af3762626bdc053eb3273d88a4b88ed2b3d616c315c8f57026b7b89b124f7dde2774aa9a1731f2cf47e0f29f5bb035016de316f5ab0