Analysis
-
max time kernel
15s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 17:53
Static task
static1
Behavioral task
behavioral1
Sample
GY8pjz6GQt.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
GY8pjz6GQt.html
Resource
win10v2004-20231215-en
General
-
Target
GY8pjz6GQt.html
-
Size
17KB
-
MD5
16193f8a52e66a020a30e284bf3f2feb
-
SHA1
31c0dd94c0bc8647355c1a28ce875a526d915459
-
SHA256
a31502acc5ef351d13aebc71605823112d352e4e0cba794032ddb47cb6dcb9fa
-
SHA512
26a118e3f9a387fbb03b0328988579dcdb49db14d80ed9adfb9c12a402c5cf361564cd0694e2caf97903e07c08cd06f1a474406b69437145861c67978b51409b
-
SSDEEP
192:hXxy0bUPqCTUCDaCny+ZRZr4J0DqVuxtTFNoZ+cmBNEZRr8w5me58F0cjiobF5F5:hXsSTR/Me58F0y7F9p60OhrfSt
Malware Config
Signatures
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC4DE781-C9CF-11EE-AFA1-EEC5CD00071E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2672 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2672 iexplore.exe 2672 iexplore.exe 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2672 wrote to memory of 2464 2672 iexplore.exe IEXPLORE.EXE PID 2672 wrote to memory of 2464 2672 iexplore.exe IEXPLORE.EXE PID 2672 wrote to memory of 2464 2672 iexplore.exe IEXPLORE.EXE PID 2672 wrote to memory of 2464 2672 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\GY8pjz6GQt.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a658eea224dd13fa7e34743dde6d920
SHA1b9ce4bd1a3bf8c6fe1d15d87ad913594c0031837
SHA25643cf7cb000fcdf570507e107d6c28be59d8f066768894ce00c46cd80533b96be
SHA512bef92c44871d309672ebfa2c07d6020b615d16f9548f7585ed748cc8314ee310c20f78ab18c055594fd0db738926f1f9a6a89fd7d2817fd00c8fd63c8874d94d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b82f19b725d980c0f818507cf35f24a
SHA1bf55e1639dd436a2c8da87d6fb58d982958d50a5
SHA2562eb7ae47aa6af170f7e8bcde619cc5efd687737b8e970148de34b8da364d5945
SHA512fa0fe0a8ded27cc84a0764314417e81c00c48fe5aa7acb008536c31a6226f78fc49950fd19e3f99f588120ce9664d71c0aa82ede357c6843a5acb3d0e665c19e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573204e5e2f2e66249682e9e42da823e2
SHA10939cb09003167406e0bf13548f6aab4bc9da809
SHA25644fa7f52b0437e7570d2e59e8359bb9c08aec03bcab94e0beff3a74df38223d8
SHA512ea1a8d24e1a064d9f61c18ca142858663f3dd248112c954bb2ef04fde68a4457d3cfeab11d774a72913783fb36e00e1177a42eb8a43643116cd5e5437fafd428
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdcbab74a12c30e091dccdff247a8e23
SHA132a09b465cbcdb9325560529bbfa3f4a96d11c6d
SHA256ccf473924cf4cf900c9b25c47812fc98e10f9a57c1d835e095a775eecbb263c0
SHA512e2bca456a67e389ccc4b1f60e783c626845c5d9baf5410b5ffb516c37d71d0bc8650de3a48e7e5d69a92e64a80e14f92c6344027dda147e6b581b3e72bc59a26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566c38a4759e4baef5a5f632eb598611f
SHA165f76f53265baac764dc6e559faf0e73c2e51e8d
SHA25693df8018aac79ea91998918f5d7b7b80c3b931927b9366213ece911d259be7ac
SHA51272bb450ee977099b91b18f900117075bcc50fe6783a02807af7987ff07fe015670cd6b28b96a5a31890f51edfef465d85e29d8b565a0284633325f6fd64c6b3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56aabdf2948e7001855af46bcd30cfb95
SHA1c819ff538830737fb1b00b0ec0042d763cc31641
SHA2565fd99d1b241ede62878bec668f560ae47fc01c05b1fab92e9168b5b5eb4bcca3
SHA512247075484a6851cdd88c40e9e995c3d67f54448b2b27ba2fe48e55d5a210c57f7eebdc8fd8a3af195f6ac91ec2bec55e050826d8f807a1cce83ec89a1fa18c97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562e445f2d56a0e2dd858ffc83c43d388
SHA1176f74384b3e052effc79eab6e5fdeb0624f4185
SHA256248233046af6b4f046da85842ce50319c7cc27727a318cef9812dbdaab1a682d
SHA51206239461010b381a633af2ed98c50ebee854c433b748a89cbd73c91f59d1b4484f6359abb0fd63dd4413615c545a19603518cd973366edd974e0d9b97e8595f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54348bd88e4c021c0c661ecc17cc307e7
SHA1e9ded3b3ccfeaeb7a91b138ffd19c5a0a32477e9
SHA256e9e4cbc6a19d7ac157f3869d27155c2348623435afe23acd6c8ccf7415a86e82
SHA5127da26a68dc19e6e938426ec6f8b57e841d7a414cadb1db6510994cd3a9b5a8c64a0ed6fe4d622e1dddc2d78bf28622d234aac425f20cdf4d5ecfb69f27917d0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c25cd2ebab83e16f1230324ad41ea00
SHA1fd708ec39aaeda3be84e7eb8fe5fa845b1d78a0e
SHA256d078df52f25d6b1360e9a022261bc2ca938ed9700e71e832df2f8b2299e4918d
SHA512ba8a75b133255a329443bddf06293fa0d4aa95c12b82ebe21f65e971500d0789cc9f58b88df09a211223b2233bc33eb2b0bcf91b555e0c35e0658ae242c3ff67
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06