Analysis
-
max time kernel
117s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13-02-2024 05:47
Static task
static1
Behavioral task
behavioral1
Sample
98a0b90f46e13c2a9e303666aea6463a.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
98a0b90f46e13c2a9e303666aea6463a.html
Resource
win10v2004-20231215-en
General
-
Target
98a0b90f46e13c2a9e303666aea6463a.html
-
Size
314KB
-
MD5
98a0b90f46e13c2a9e303666aea6463a
-
SHA1
40917ce070196cbde62e48ae65e76954076cdba2
-
SHA256
07fcf750e552ffe43a0578f98d3e552c9ce906cc1e3c0928355737ea93345bfa
-
SHA512
45078b360765fe33ba95baf93fb69003ba3e390ac124a549fc9f84bd6b7ba5a4921860ac81d90a6f4877cce582d3f7ed68f133b1c66593404ff5feafe42773a0
-
SSDEEP
3072:JJWwys5uBZg+WJhIczPdYA78jrz9SdSVkw5OTgGT8eF4dZQ/i/Hc+TIPQeXEJFfC:Gwy3QJhNJSWw2JT8QuZQKE+TI4eXE/O
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000db768068121ea73613eeee0133b2c663e579cbbca078f9d1aab87171b3bd9d83000000000e80000000020000200000008b6e9dca4a13d58a9b9b8c6747a3108945ceff915e3fcd7f9e22638d0711ec04900000006af5d7cb551f4ef5c3046e6cd802f47fc4d03073b2882eccb111c2f54b19934c89109554867b90b669dd25413499681c8682bb6e997f74cbbf681e9e139121b349626bb84befbd67426c081c33ca05ed7a30a31084b6e3ad3edb50eff7b77efd0a416ae0874949567e9b984022d7754e076543f7fa0b9ce9baf2af9e48e02641f82378ed76658f500d7f5570b1516ec140000000dd6925e441da0d1439fddf3b81a31e532b257f9c7cc189228197f2c112e5c581773c3b12a5d9bbb75f11486dc9982c7b0bbf861cfbcf2dc41e951bf373e3c0db iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413965142" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{617DF6A1-CA33-11EE-8FC2-4A7F2EE8F0A9} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08aca3e405eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000007cfbff03c9ff1dbc5e10ac8d05df8d75321dbaff589bd497690b6397b01a0521000000000e80000000020000200000009646d75501529f889a549bd780b4afaaf7edb41491cbaf7a6aa5f9eacbb0aac32000000070cfec266d65c05cf8e778964d71998db042e0b5bde8118b34795b728ae540e14000000058cb5c5b93137c014a076a8089c3cb959fc3e192b28d47ad38dbcd69bee5420d621c25d0a9bccf14f3d4706d964df951bba217fe07d8b4e352cb348f369d6a42 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2800 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2800 iexplore.exe 2800 iexplore.exe 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2800 wrote to memory of 3040 2800 iexplore.exe 28 PID 2800 wrote to memory of 3040 2800 iexplore.exe 28 PID 2800 wrote to memory of 3040 2800 iexplore.exe 28 PID 2800 wrote to memory of 3040 2800 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\98a0b90f46e13c2a9e303666aea6463a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2d57ae4e444bb14cd43b569af469625
SHA19f346ef727d37442f24519dbb46905e54cf0e2cd
SHA256ab1123aef53e52563cc1f292b0d5ced8f07de8be71db3c6aad50079ddbd37e14
SHA5126f5c58fc0f7683c8438782e829823ec87e28d5caf8784b302c415d974f648cd5fa0f0fbd6e5229241d0052aeb701bcba6a40565bf24d8a0a59f5aaf0e896f9a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5892f07b8eacf46c6e91b138633945a5c
SHA102629d332b95c1660f6b2c7ef6ade1d690156a57
SHA25654a74a467142a834ab217becc2b2bb85ca59e9ff6efdf6f17f4bb3cd581fbac6
SHA5123128ed3bbf9b7730f05d824edbb889be31b178c2774bee46d680cdee8c4eff2999f879ae7f392f478a736f4522e310795039ef1bdcbb1dde4131e207c4784fff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56773b95fbc3a1632fb0c4b8c4719a7b7
SHA1d69d3d1e9ef8d0420b51167393c61252d4632a3c
SHA25686df2d1053a862b0c09a6ed39d03db4b01bd9fb8b98370d5677d71d718b5af2b
SHA512d338929ecdf8eae19d7a8a4715637260722dd875d2e5e29093dcdcae5eb788a687dd3b20dd9a63a4664953c2fb8c58128ce678b6706a8147c887d2db89615075
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516baf481ffa03a2d759c7b74dfee41f0
SHA106eb1f12545b0a88a16fbf9804b1ec6342648574
SHA2561ee4a1631e1f7b7874176b304f713222125aa6df6cf2af1448dffc02c17354f4
SHA512efc19ad6c1f6750420993253fcc6a750e351c0eb335222d0c8614fe0fc0658175de2e438ff0ad5223d157151d299cfcb53c9a71a66680b9be1c57312c2396988
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f061144207b2608a01a4d46328d335f
SHA1b01ea0804cae12c6ae31eccaf081ac91f7ee8da9
SHA256c6463faef656beca9cb0d37a4c9f1d0f5a15d22ae99a410721ac09d8dd5e7483
SHA5121d2d81b3b92d2c7fa0f009a774b6425254428eb5ae5a5932dfe439b0b82d0a20f07da6c19118594f33877d8c06dedac0d9c01eb6182be8654cee259fa1cf1eac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e78455718a497664b272e0cdcda55403
SHA15781e7c25a8071efe603c47615d332ef4569af72
SHA256e5c6c22488bc637d82edd6331b5df54caedb71a47fa95fb987dbeb0db21792f6
SHA512231a38b2a717cfa649266c30a355fb0abcdaa5d8f90bdc44de08ce31e1611e285afb97860eb1a35ee9b84a7fb20eda00204309bcf6c79e6b37a682f45a830a6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fe4b73d95c9ae935abc9effa26f480d
SHA1a08f8fde297b518836927df9024fd3c0f132f2cb
SHA2566ddf074eb2a0e9a3cb5b7ce1c5c33e16be78c635a610592d1eb8307be29a6049
SHA512c09e496c0f3b108ecd3ed92c342a0dd33a5c05335ce35d11fb7bb60b670021788deff139a3cb90c82e22f5d53c1c973c90a43f91717c8389aecca148326027db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5543f5ff20050a5a1f7e6a4e1185f3bbc
SHA1e9ad403d39bc8735e51b524d1f018c56f66a4bcb
SHA256f34e70663617a5e35c690d91ac935d7fcdd047b49d6e17321d370de8ee801c3d
SHA512c20997f30fa91343cd8acc4fb55f0606f2955106f88866e7ab1c3a6a065bbcd2c7def2ed88dd4012bd040877eb219ca501de2ad1a4e2e06063a7b7d367b25b6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56584c75f14b8f246054bfec126c4b06f
SHA1c368c69b7352e386f81001b848419cf284be2639
SHA25647f9521780ad563c6e76d3c76538bc62d5626c594c30a930a2e372a63500659d
SHA512407aa03ea904a18b64f93d24c33bc3c373b401ff0d353967e785833f2a2b7b31c9afe3da2080c17adca728a80bcce2c9aea615bc19fc57c7bda5aa870c58e164
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6068dcbf24607c01e68044ef6742bb9
SHA153bc9ee34a944e6e318757aab2a42c8bdc07912b
SHA25621fa7eec219b440a12c05bfd3a53d6ecadc38b1d559b3d236ae90b5a0d7c0743
SHA512eeb15da815250de52627ebd4f373bfe328df963cc7280c65face8f3fbd4bb2526eb43208a774be04ae45e36c0c5ea02007be033afbb0c75bf132077622b61135
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e1d831487783aeb7320d9f79a504184
SHA10951ceee6010ae9f5f62647c53900df266363209
SHA25668eddeeb8638406712ef323096d6cccf21402dce1d17bb3862ba95463af25df6
SHA5123099e9cf3ce1d1fc38dcb65219e2b8e1a262cfe560905ce0e5c0fe7d3d86b233ca91cfc9667a9346a1cb4ec922e0b711e4ce097a46f99c11421d66b3f4511cfc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0c7ede47de993c548c8c0941df88279
SHA119d5570d3f016eda78247c282c47c82511e71a48
SHA256d2091cbe793eb54e1a48eb472505253588679cdad7860df512981a977f36823b
SHA51298c03ea9ea4c8692637d5f6bc598c9e343770e7219dd476c37190d84c75418bcc37f0b056fad98a82e0713cd1ea62dd3daf81eb9d088deafd79cf796f9458df2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab75185f98787fc4c046a2c40446a11d
SHA1613f1c411caec8fecd645d50b49f869190ffc648
SHA2563553534028474348744ee728114391ace66880690d2096856ea4a81d9087aed2
SHA512f7596d0fe72789dfef9244bdaf1e19005e37c8d87cbc82ff166cd9871e5e82fef1562309ce39cce5fe383aa968c17e741a0db5238ac19e9db87a7f55262f6d5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531e98ea0074db164e7b63a4c48c8a0c9
SHA191cf2cc3923e9f339e38105ae754b1c83a5d0cde
SHA2560358e8cb2689ad5e5b0541d9f6011f1c4090a365374c879a8e630a66ce8df1cc
SHA512c3b0491135ac48c136f65f75526811a7e2d11dee0cd377918e2e5a0ecf112ef1cc6dc382af6ad2a0448a390887b822ae73a545dbeff0f9a4023dff88c872e329
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4412061070df4ab07fbfc0e0bcb6a50
SHA109e69b31ecfc570556ff979022e15a1aff67f1ce
SHA256f68489dcfcdad2bad0f4aeb098874f3021de1b29517eed396649df79b3f4ed9c
SHA5126012e3a4f32e5bf25641a44a13c86da85979c22aa3b84c514bc67691fb63908948da959195164b436e842f16b4eda02c538919824b3d6d6db97c1ae703c5dfed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561ac86298f6eabf59c2759017e03bc44
SHA19d92ace6bfd5a055cd7ee985aa9be89a2d184a05
SHA256378d5711511a9a57517924b9d7990d43082755fddb4345b6578940d602dd3192
SHA5127b7e149889946abccdd342bf427fe8c4488e2695fa490fdf856a2182f264f51ecea79b3eda54b2e82c68cc732bf125470f1e42025a7d744be7a54382633bcfcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8122ee72dfc6543de85f18f24fc7dba
SHA1312f4ebc1fdfce60792137a5b55014e609acbdba
SHA25615c53977a87dc8c1bba0b72b086dc598319e952e069cd89ef168e4f3b00766a6
SHA5122f2ad3db420ee8d63c0896ac974b9652ba0e63a53b815be0c50b518a4d2537a724bb931a79a372d09924512da8911d9f276401cbda0f8f006553f7e65623e72b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a3a2abc36b6d55ce87ef874f7da0f06
SHA1b1ef79bc0ad86a5373265b184cff7efeea6e2f63
SHA25677d4872be20f5294b0f0c0367e2ba9b0cf8ee58ba75649ad7350e487add6aff2
SHA5124a78aefb940bf45a1bf1dd21aa1084a4a7d4cdde37196dd9a5a1b646a6b4a0cb169c61dff5478d60f300f0dca234f36621006cc39b5a6e858443e454cb247a5f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06