Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13-02-2024 11:58
Static task
static1
Behavioral task
behavioral1
Sample
995e2b236b13a37351c6c5e585633790.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
995e2b236b13a37351c6c5e585633790.html
Resource
win10v2004-20231215-en
General
-
Target
995e2b236b13a37351c6c5e585633790.html
-
Size
23KB
-
MD5
995e2b236b13a37351c6c5e585633790
-
SHA1
e042ced8b3fbab33fcd8bef52c92165ff371a01d
-
SHA256
8db590e81f9273ba9bfc814652cc5c520d003c8bdd6ea54d03690deebb528f53
-
SHA512
1148e717e1b6bb410d993365e97c3c7d786cb05066c2527babf82e3abef220244094f98c0fa5f1c26111ba1c4067ec733f0c297e50657893cdb6744a81c49995
-
SSDEEP
384:lnA4ywOi6p2fDaztvukeKXXTuEw/IiEn0KL24UTpNyOcn8tvG5nTDuU5esT8a:N10i4tWkekbwn9Kc7wV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000036dca3b166bed6358c0f742e7044eaa67760c73b306d0c3ef007c04d141f0367000000000e800000000200002000000080a9e95573315fc965510fe9fa4510b66376af34f948e726895785b26105c9d320000000f0241f13a82045ba9b1f4a80e48b579e3372b22adb413273a3632dd08e3a8d50400000000f2ceae3b18c4b2bf0ce40403dd63e8ca5e71187339469d89d65404cc4a0c8d7aa9998c147408f3f7a85bf9b9051ed3d871b7a20b4ed9f5a6278332ca2fe3c10 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ae8f10745eda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413987392" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ac8e5e8b68e1f8680af9be2b187296234aa08e97dc271f5c96b40e835ae8a85c000000000e800000000200002000000098394a1272f6811533f836c6c7fc9c84f63843f89d5e56b78ccbb1d9cc4904f990000000a043c4f7ba7eefb81e11d6d09dd58b056eb2adae6dee0c999b884c7563595ffd872cac5d3631062e6a25940ecaff31c961da3ad120f2574102d9d27fcd2f1201c8cd4b645360d207fb3cdd930b5813f1dc57c06767605460f18b9562b43240bd94331bc322123292ef3a968e6ba861278ded456066f6defa6dbe10c19ab9258b82092155cb40be933d6d4d0b2e2ce2c0400000007194fb0f1405b926db0421391a89f76224d062b8aaccd8d2a72981881927cb8d91d4b2b313f7b7bcee884d85da60cf46256090a86d76761a1fd76c1382d3360a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B4C8991-CA67-11EE-B7E3-EE9A2FAC8CC3} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1672 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1672 iexplore.exe 1672 iexplore.exe 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE 2760 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2760 1672 iexplore.exe 28 PID 1672 wrote to memory of 2760 1672 iexplore.exe 28 PID 1672 wrote to memory of 2760 1672 iexplore.exe 28 PID 1672 wrote to memory of 2760 1672 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\995e2b236b13a37351c6c5e585633790.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf1e40cd888b17d56ede44b79f9f1a4f
SHA18cf1d64e21234b528f27b01754d488b58e7120d1
SHA256623a99393e031912f5a9e0b3aae0e2878e169b1156ecd7b843a14aed6555d710
SHA512afb433cf26301e22ae09138cc054332549f31a2de890e903499fec43fd1678f7ac0fc0dd6f868d8974ab671710fd96e2442f512d63df5fd6db20eda9f91fd6de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587f99c0669b504bfc22029c1082a05db
SHA16fa7ac3b2cf5b7326852e7e17eeb30b39a9a429f
SHA25669dbf43c6cf60d16dde9f3a653d9d8bebe623d09243acf8924f7452cd95bc5df
SHA5127622c91847857a336fc96e66614c94dce61d31246d0a5d15beb835031a09d1863c1202238ce63d7f4d81a0acd2fefafa56e8c5cae65c7ebdd3f6ababc5e46047
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559add2df0c6c178220d01aed8f2e6778
SHA1ec3b030fe2f2a791b094156b33dfd3694579f83b
SHA256f0a0210f2df9128c6146e9cf285b9a07936ed6b7f2d4554910fbea36c9cb32c0
SHA51218918cec2b166c4832f1a08303cfca2946e972ebd3a0735bd304c3829e027bb9002d7cdfb4ecb8a9134aa56eee290af82b1e20e19501eeda99764499d0e26313
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5990688871488616de181d09672a207e4
SHA1ebf49b0a4e05f08856b918817344c0db5a1df932
SHA25650299f2e4c5233c9460116ca88f73287a425cd5354077eaccebe04b43bf078f5
SHA512045211d7ff5e50807b8689b1d3cfcecfc791786bb7e26cfda3f574c2ce5c8281c8a6f282eeb20138ee6e7be0c581535fe2adae28ed6bdc5160afc605eee1278b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5858edaf7aa69a12d69821d2384f5e217
SHA19a36ba3dfc2cbd57ddd847f188567fa5994e71d3
SHA256018c7337ad02cec2a81eb00a523095c6d88a5e6be341d85b5ea30a835e9f2129
SHA5121bc0a4afbd595980582b1111113c103d02f2246680ea8e940cc5a39edb00d623a3153cf2dc8e6ee39360089effcabd17fa5f005f8ff62b990adcf537625f1484
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525edfa5c2d4a888c5aae1661c44c3268
SHA1a2f353d477883ba4e3854813d56f4797f458dd12
SHA256aaf7c9aa93bbe7d6d4a40cf05916ee3d3454c7ac6b42b5a389f0d7495a62fa1f
SHA51204b8e3c8d1fb34f29d83e0fc644c7476b0cb73f54ba4969c158b2eed7bbe3b880f4b378d9c37d4fcf8192f3fd789bd15a3d6c79288ff5c8a35162220873620c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6d5f99abc7b76390141cc7e6990ea6b
SHA17f7f04d9ec12bf999739b54d012657a1e265674d
SHA256a9c4648896e774e27e867414b439ed1fcb4aff3b80286422c3885b6824044582
SHA512a9d728c0375135a975f1674d442f8c1c19c1bcaf3aaeae23be409fbdac8b1591ad1658bcac66e91aadddfb8a08f0c47c9fee012b4d9646f63b02cd4d26f47c15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569756ab21e5cdac4fd3d3d989d6cd30d
SHA1d5d8b099b0d76b43050e57ffdfbc78f6343da639
SHA2563308b11536982c8c5796232a94ae08ce3122cecec52b6783ab3d01f95bd2fa33
SHA5128976494925566ae9bd54edc349a104eeb8a53e0676976dc683dea1773d7a1962bae8f214827a35cb616ca05ddc16fc05bf08e12a1f6c7f2b4bd5050aeb53e732
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd4e135a32cbe8d28da8ded89bf7b16c
SHA1a26202d7afa9f0d582ff451bc632ce3bb5047d77
SHA25643a909dbec8b9fb1c8f5e4626b045b1793be7acf438d6d9f83a46fb52726d4b1
SHA512130c58a3de2dffecbf8c53e5601fb997d9c1b56f5a23641a6938edf146d0e6bc75f07ae064a6e399fa4c9d20e3cad3d37d10d0ff959eda0a1e3d18f80744f660
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a8d961b2f86218499d0d8cf98eebbe4
SHA1e1f587a6f6cab7181d4ca5f3b47c4f356fff855a
SHA256f343e48622042372227fc4d3615c8ad58100e121796db8efe594da4653645d97
SHA5125c22a7765c806850d3fac441dbb9148409842d86d25ddbd1cfa00f0b1aab8cdd168a14073200c21a66ce595374b2fbf3f64a9c17ee2bb8e19803cb016c08ca4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c03f72988cc62839c8d995ba88504b22
SHA13491cf656953aa1fd02bf3343fcd8d33fc1cbd63
SHA2561671c7b82d739722bb96ed57838c903d3928f9e2c77791b79039a2291d97d4f4
SHA512391246efa8a778115731b43da0f352f9446b0327daea70ac3f78a3478987662823d3646182ffa9801b0b22fb7e86c76367766be4a9b5eb3945d749d1f0bc2cc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598431c9e7e2a7aa4b91507d4d4023d3d
SHA154fc6cc29437c69d4058c3a2f02dd5c372234455
SHA256ad5a9978c79b9985043767425f2ef57641e2dd237e6701349fdaad72ce009e9c
SHA512092087ee45c63f20693a33cd34c6f5191f35fa6711fc180520187d926efa75f339f7c76a2b9a1736f3a78b1ad38c39c64199c54b1e6811a1d1df19f639bdec70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5096b1ac2e02ab6a95a3f4c51f223fd8f
SHA15008d0a5d9236c22bea45748c893f8a8fd3160f2
SHA25605f11af2e6a4719660da79a25a12cff39a4319cb49b1edc3a84c68d762b9137b
SHA512055e0684ddf1829f415f43c36887538082772b13420f7ec8c9e654eded457b43de0dda61dbba5c4a1b02763e1e1d509fb9ac13ab9911f8b2e90440960a4b42a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595f069ab425cd641cc4032f1bf80e22b
SHA118d65d18e991d763ede67568828041d5c9514bd1
SHA256e5b97a6d721f9862da6b3b2f57e6807475200202050363bfd697698848e4f16d
SHA51291df19cd001866a874bbce98bcd92dcb3d2879eaa2fd2c252b0aefd27684487c9c8560d6ea8b96958b3c522c0ac01413676ac80cd6458707bd54993222ee9056
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5890b32dd3fdffe4bdba140490768ea28
SHA146d7a5a1d0b480f0e92db5b3ea93263674bc4362
SHA2562dc3588b9f7e274dbf7a7613da28902523f932777c4983fc64fb552f372a569d
SHA512a49d0235298d3f1dead585f57cc3d1e09bee2618cf7a11dab525f961966a9904e83c17ea31eeae8b4ffa9c6e0c4702111dcf4164b86929a2ebc923a5dc38070c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c653658c35090ba255041a862e71a6e9
SHA17464eed2cd1c7c5f9ec30ef2d4a5ebfa0e278c53
SHA25604e334ab94e997f6712dee4509dff08253e808fe299b134e06d3efb35115a3a9
SHA5126f29e9e9bbdf42efa301019fee94d498a65feeed8161239b5ec2a1b8fe0027232baad7d01364eda6d1170f643e1042da55189c3d34d7ae15b2b1bffee70ff047
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597753ee20db5a44df26d850322b9a377
SHA1bd7ed886daf0dfc094313f8be34b120b150e1646
SHA25671b62db9e48ce4c447d1e3eaa276b0fb85caaf29d9ba3dded043635f1e10b3e3
SHA512b58251bb19b53a08f66d9dd7163f6924c5edbf1a890b3ce966672a705650948ada25b0821b755ba27f8c60bd8fb66c49d17412abdabcdd38edfbbf586035f126
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556f48b3746dff30b6515e11a9003554a
SHA1b9b5618e17a617b200541ef81441647cb9213e05
SHA2568fcae6612325a2c36dca3a979e5af69ad1d6ab48c22ac55a66019cc40876fb74
SHA512471253caa32523f459573ef31d8152427a5e519cd2aced7319c2bae1d5076ed6ae6adc399f8ad138d8e880747c351df48494c5a52e3b4c5949fabf198cace0d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53799816aba2488968e15720e6847604a
SHA193e91e19a475a6f18f342be8f7cf8c381f848efd
SHA25697c54ab5fa651f62a25dcd94afacc377f29004e59d676e5161022c7371598a4f
SHA512d347561d1a57fdbd1896cb7f60110e02e9142bf88bd45c83e7237830a1322bd437698ee1aa9fb61de9ffedda615c41eb669266d7146c0450873cdbda9eed32b2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06