Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14-02-2024 02:35
Static task
static1
Behavioral task
behavioral1
Sample
9a8937bc771116b82e9d97806a9b7636.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9a8937bc771116b82e9d97806a9b7636.html
Resource
win10v2004-20231222-en
General
-
Target
9a8937bc771116b82e9d97806a9b7636.html
-
Size
14KB
-
MD5
9a8937bc771116b82e9d97806a9b7636
-
SHA1
f933fe497dd46aaf8620f4b6b946e6ec990f373c
-
SHA256
aa44c407f0b61370f75a0039edfbcad699aea298d06218d5e0475097ee4cdfd8
-
SHA512
ba3ef8f80b9f25e7d8a4cbea129601c6148c2de4b291d04f0b02472d4643dc7e89e455f6188eaa98bc419fce448806b853c6006ab39afb48512a59b1edd5442f
-
SSDEEP
192:+yEioELD/ZmXg8oWllefMJkZQ3wf1v2mlKt6DvE:aioWD/ZmXg8SZQBmlXrE
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AFEBE1E1-CAE1-11EE-88A2-EEC5CD00071E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000040a42bf34682a0113155f53405454d9a64cf1618315aa6c65f5352860edacb11000000000e8000000002000020000000398af5a72a883505acc7d0eead085b384fc461d4d2e42606e81e2c0a11a8c7e02000000084d75526f829c5fff71b2a4511d68c9b019def2d32780d22f7351a042566cf1240000000b34b57f8bbc040582c4933b03eb4c0770828569a0f0cd6df5ff8ecadaafb3580a2c20d7ea9261d84e4d345dea743eb0f44e02fe03f5a0e37dffee734ad3e1a43 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414039984" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0519284ee5eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000020ad0b741bba1207d7dbe54787e059e2d4ea371a88339040359a630b2ee1f361000000000e8000000002000020000000f0c5441022e690462501e6b9e54974bafa56c0a11e97f31b217fe397bce0d7c690000000c6dcf5107058719befe03a96f09b88bb10db53f0e783bcf7d78f6efb0dbc85ebadfaa0ee54b916883018af2471c772233162098548e3e5b2049a8f3755fd8e19b4831b2f76d80f6ee647fef30bcb6d383b9347370def3a884bee1b027468758469d210af1b96677e7484304e2debf64e943c3e600a291785842bca2f6406ebabb21255fabf99b415a38756f840395732400000005cefd22a4999a79aa938607918c920c6577e1a078e27715469016618b6f496d804566236072bccadea4dd142b3ae3a3db242af197bf844595086c4b646a8c010 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2060 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2060 iexplore.exe 2060 iexplore.exe 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE 2652 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2652 2060 iexplore.exe 28 PID 2060 wrote to memory of 2652 2060 iexplore.exe 28 PID 2060 wrote to memory of 2652 2060 iexplore.exe 28 PID 2060 wrote to memory of 2652 2060 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9a8937bc771116b82e9d97806a9b7636.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6fe6f8d46c5a80ead6071230bbd6196
SHA1f065be23cd7fe8914dffbe4eda6f9564d5fe93b8
SHA256f3976842c175d8bdb04d6eb52cbbb79e76dd1317b9dedf1f6c132de48bfc3bd3
SHA512505556efefe9aa3cedd0b7ef5d35ae1419d23fd8910747a4b258cdd3f1872bfd56ee64c57ee69519f7bae46686eaa2e2fa1faa39c10b17a1577442d26bb255de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5297f7dda5e08a358dca404ce35433be1
SHA1e2eaa10ff21385002890688a8a4b8abd7ec93120
SHA256843fc6da87c4e84dbe9ad3ad4749dab01113e69b051d14492f40742df6784d21
SHA51271a518dfbc4a036e096dc86ea1be22cfdcab1722a8fa498ab9cab2446ea81ca2e4ba17d1fb449073bd29a7167f1e945da4c23c15ba99c14cf5ef0e4cb7921390
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d8b6cc247a8fed2c4e8328f65d239dd
SHA19823ad989720f8d4dba253394f4a50e964b5f362
SHA2564391eada64f652dc52103e113d764b50ec61851db4bc7cae2d9fd59e873ba824
SHA5128a4cb35346a02bad1289871d5955ca636ea30e0f4910eede87a327e6b7bbf01f5825c7cea1a7488ae34093ca4f5ef20e336e0ced4299f5adf3a0f4beca8d2625
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6021d7126c86020d3222886ac000a2f
SHA133c1f188ba8f0e3503484923b4fa997a0fd9c630
SHA256c7469951f31d128a85bdccc2c75ad0121907a965fe0d8a1fbc282716276b74a3
SHA512b39de0f056b1b45c8cdb69dcdff2d13857850ec6ead5657dc62e61ded155eb9625b7546acdc2469267e05d4185503ecafa315c895bc37ef4e568e3a1b508d072
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5931aa67eca71b8efbbd18fb3d2616975
SHA1db27edd8ea5798690f38893921857f51fd9d5f8a
SHA2564dc31521f4288d1583e3e1723f8f7a0aa21ae75c8f72c2ae0163419b48e81c55
SHA512658f762aafe384d9ee525355ddf0e00fa90ea63f558894fe8ec0c503dbda0aaa0cea0746f8a02ad70c1b714a6d427dcef93dd785b1196e3f618fdd3fb6d0626e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c824045306729019c4dfbced186e477
SHA1f6a90b5c25a8fbb662086ea05211c236c7b3ae64
SHA25684ffd25dbc76cac66db54e5ecd5f8372f1e94d3e669faa7fc55f1e0525ab6c27
SHA51269d2089510a40b78860eb729887a4365f7bbdd903f49770fb1020dad0daffa695cdd0c3c6b7b88f264cc213833787318f6c96f8ec02fded387d28693dddeba9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5873d45d274758db272723de782bf8c67
SHA18d6598c9029b2f2dc36a15e6090c81a04116b49c
SHA256672c371ac71323bf725445386115b5809b718fd79cdcf7eaa6f1f77fb85150f3
SHA51272cb97b0cb95c08cc95757b65d4fe665694af019cfc27851ebd816126826d3eca22de71063d81d3dbb1b3c9107143e77d3ccec6d462c3404878e5ce7ff044939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b363df0c403720ac9f18abcc055d65f0
SHA1689cddb1e92b0f4e17326a3be5f0bda6f1286784
SHA256ec21ef93f3388385d8410303634f3685243b3614465c1fef9ebb127d2f187174
SHA51244ae24cbc04b2decca2c2b0980855eee015d788226454098b8d119b0fb9eb77716f5d850ac68e80116ea214c4293216b1c083d8a5bf59ffc7604b9337c147d3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5360b000f9ef031c4c976889140d5a22d
SHA107381607bc629787dc8ccbd6d6ee01949664d084
SHA256743a60b73f8e6db17b6f023cbc3586693bfe20d3e7388ab4ecb1cfcfd411daa1
SHA5122bf56a2aeca0c89f822a6645bcd8940887da8af2a5233f2eceb4c1a06e7b0a37eeb994cc755b07178b01254251c88f33d4cb9547f81a48818fece8fdc4f56e80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb24993825ab33b34414144b091eb6cb
SHA118ac9257bce9afec189d028ea06dee44d74461e9
SHA256276c192c247143eb63a41700d57f5e3b933f5159c5a78fd8705707708f644b76
SHA512130dd3ed54a26916cb53217eef3b98260c5b994eb9402ac53ae8bb5eeaeebdd58bf7bf6235f29db68af5f54eeb8a9488a82494c65b17ac6c1de2935a8da2fb5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d8ee5af4d0f8ad80d68195ff5f61592
SHA16b17ef59214aba70cd438afe9f3fd26286a60edd
SHA256c55bcca78c781e14c983a3ddaea51b78c184859e927278a0f13acf67c3d77430
SHA512971b1a0fbc14e4a5c4ff911f0ff06a4c506e5505909f5f49df2dd0e8da6ecc970788de201956ea20a5a7148ce530d1ab9dc9d84eeb43b19479dde2c4d8d82e0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585adb214f530245ef7779ef8e7846aad
SHA15354809bad1b1b4ce6e049e2a15adfa4d7e3fb09
SHA256ec470745d01f08bddf7be9a7eca7d13356142b39950cd982f742ac2ed7ad3c71
SHA512cb2cc5661ee12312e2b687dbb094d8df03ce800fc478ed2ba746b05a5d8a1c139fa81c36b32ec15af71ea7018ad4b6a86b1ff938283fe6b19904130cc1308a86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5064072f829cc8fcb328d6d3eb79422bc
SHA10e12dbad701299a63d35976690accacd0af9a403
SHA2564e0259df183a94d3b97789f83c186bb575fb67b301aeb62a4c07ea5d364ed675
SHA51258c7a964ad5470b70167055de95efe7daf020bc169a8ff7abc8291587e3b294eeefd75b84a497c4226cd687e8684615892505cc258cfb80656843883fc3a59a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521c5dfc787b6e29569b8ca6b61c553f4
SHA18a08aa765a6b2d74406e65453623e92fe163eaa4
SHA256a8f88c79bfe94717fcf6261c138e40fbc04af4e1254e330303898c7cf3b22798
SHA512ffc000ae0409c87da3d45fd2acc26dff42694c199158c86f8bfc1bdd86a46f5fe01be12e377f8cc0633cb2b534d5d0533a223832f20d4aeda23a5f15d9208270
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5208d097f358b852a018589d1b91c80b7
SHA1a248bfdbf801b0943e17410f81a2a3d481ca3bf5
SHA2568450e9d3da6d7b13b3adeb0d253120476469aac8116857ba3ebb6d078c38f1eb
SHA51247cfdf2480366df18739dc806f5dd116b3311d2eee02115d4980418823ad04ffd48074d8142ce1c52e244749f7169a8125a4d53852cb75558851bb4882a78292
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef1b71da62e09d52acc37c13d43a8d98
SHA1911137e2e35bfec87ff65879730e199cea858f40
SHA256df4c83ec60986179add2a4d67d22f4bdfb49a22cc5d377feb3c32b0e912c8abf
SHA512be659ca5e09be1a419e817c4f536ec1e5d84780f6c9a6f3c49e91c9c16038c64688f898ad8e0e0bc31597a969970ef23f7e7f436dca90c163824eab336313083
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae6d777f9e0f0965fcb2ced842bf7a81
SHA12dea96cc9cafd4e9f5e25070024c37fc2aaa96f9
SHA2568eba8f2163cc097033235925b54b8c4457cffea0bcd984a137b77a6c7529807a
SHA512aa1eca121255affa3747b2c65be3e816dc7b3f6c76209fd956fab2362f1ba72c6202e74a17796a5bd310663fd0cac1a2dad2d35eb85cf9d3d5a77b3d4b79e4a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ee17d4a46f55873eac7901b2d74f28d
SHA1c9aa1c428509fd0af3abf9fd044ffcd88896aa4f
SHA2566b40b40b5c01f2553e7ade973757b956407742ca867dd53d47b63d59d0dfd2a9
SHA5123e5bfa80068c6eee8eb9cf695dce553e7fb0958a0233fd756f529de46b54d31065ad5ed11ef149c703213ee92a8b161d9fb6dac83d6091974d1f9b1e49d9fe75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d22d4f6c406f3a8327f5122b8973d600
SHA112449010fa2132cb17a42010a657d970270da224
SHA256b3038701239ef09ebc1a989ace04e458df25012c0746d056718303119186caef
SHA512ee2f403857b202c9c6e65f4d39b80d653d921ba27e348e9c190410952e3c204045728969b716829535af06fd5173062b9115ee1d79c95a8bc579ad28d9a7006e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06