Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14-02-2024 18:05
Static task
static1
Behavioral task
behavioral1
Sample
9c4ed63af94a4eb3128109216a46a68b.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9c4ed63af94a4eb3128109216a46a68b.html
Resource
win10v2004-20231215-en
General
-
Target
9c4ed63af94a4eb3128109216a46a68b.html
-
Size
40KB
-
MD5
9c4ed63af94a4eb3128109216a46a68b
-
SHA1
0be3446c0ac8a05d8b278106fdb219d57b4cf7e0
-
SHA256
dc8da0d6738abe18ed6d120322acf79b93f49783d3e385ea1a7df4d171822d3d
-
SHA512
e42153a529ef5f4c018dae474bc07c9e9467442e793433c874a9c53ecc5656ed6565d557dd291bf3fdb40e12983a8aded75f0174308ba0dcc3bfeece3fe59988
-
SSDEEP
768:JTTdcqpX/pJdgsxrX+5pt4Y7FZeqk9x/tsN5yWU2aNtH:JTTdcqpvNgsxrX+5pt4Y7FZe3tsN0Fp
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f5a484705fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000e29d3864a37201c320e09b7a34603fd31a313f8f7a0bd3ff7451dc793345b79b000000000e8000000002000020000000af2d9553667d6131ff11504c8950bc2bf169c1bda0cc9308f7618dc3d08ef49d20000000cfc883f352410532c9078708e86207bcb166f0f422d80dd1f6fd4fdaffb3bf7040000000947437bfe9d7c07dd4975dcbae6f6035b880c076097438f4827d264c797049894ea98b41021526368f84b053461d6b2bc9821abe6c40d7f9695c7d2b742259ec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414095774" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94961A51-CB63-11EE-AEE3-EED0D7A1BF98} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000007ac75bb73bf4552f67d7316620557b7d1da2209c2e2428427c165ddcf8f103fa000000000e800000000200002000000095cce782fcba571b8e85ff33928d08aa2401ad1d3d1ead88cf6355562dba36bf90000000acb99c9fc041c2d9d40958d6905c61016ec2ad1b1fda4c9be8e4e7dbe8cb7abe6794e2abd4f7195cb3c1c64eab57f6f390f73414d58604db9daf5e793659c8cb8cdca33ba5583ca8c2cff1875e8f35e0926ba643747dafecea2d5d4a80b9c59418376359232e2598979950ab5f189833fdd3cfc0d53b3901479586a78264ac35116f7479291f910294f19ac27c0d403640000000468a3a0c1a0354c636b5ef3a8e213a1e6c53be924bff7f74936d22a55ae106fae7a371d629f59f3d62414ac19c776a1053abf022ca18b6793aaef4167f8d09e4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1724 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1724 iexplore.exe 1724 iexplore.exe 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2828 1724 iexplore.exe 28 PID 1724 wrote to memory of 2828 1724 iexplore.exe 28 PID 1724 wrote to memory of 2828 1724 iexplore.exe 28 PID 1724 wrote to memory of 2828 1724 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9c4ed63af94a4eb3128109216a46a68b.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e117d67fa74f6960ff083be1075a0c7d
SHA1b10c771353e45483705171eed50b232ba8f8a58d
SHA2568918e0eeb817215141456f91531095ac60ecb5e61468cc06ad66a3ac1859a631
SHA51276fe7828d8d4e2036293c26a15f6632bc858162619e2547b1c67009dee3dfa37b2e00449c88cec29adcc25ec20cd4f6bd408ee1e81e7b6c5576b08bfe5927457
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8101474ce42b0da94b8b20ef5640531
SHA111662f75d44115f0cc099ffd6d59d4df1d9de07f
SHA25665c9a583c98433117725591076c91c3c087d0b239232419cecc9f9ed4cf15270
SHA51216e70812f456328f87e4688e6276c47f588ef5d0d4d9c166fe3c4583d50a5dd1cf4eac10936e61113015196e0cd0dc1a25135eead1da3aee93aca41d648fc583
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f99e23cf52bdb8524fb83c60dfe8d68a
SHA102dedca9247e8001509cf5bd52a24127998eee49
SHA256b3a7e6130127ad2651264fcc84caf39b48384a0864aecc0be5ac9aa8f9448168
SHA5124957dc60c881979b05f9c8bb10a22d633fbd4cb292afccb8b9db5e1d3fcf5f3daba3c7260febfdcf513d9f1a0ccea87e8ca8a789e7cc34abf6c24a08585c99bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f69e2f87370efa1d862b6516973fea8a
SHA16d21f6f39bd7ddfc876e145aac9d78dc8ef1fe53
SHA2560741825e2d127e452976ea61f4bdd2d4012d7d26b2d698061430154ae7a63fd3
SHA512eec1118329057db6f447c1661c414012a7c142864ce88b5e1a89719cec56c2f2601bc60f102d16c54da29c9b2f5d1977cc81c1537af947ebdaaf913db55d7e15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5775c67082d3973e3f04e4831be4d562f
SHA14dde1715a8b053c13b84803615624fd6750bc716
SHA256a524966d06697b5615d6f36c5251cd82de956209247b921825d6bf83d2cfea43
SHA512efa8b22944730e46b10e6df46813530be85f0f1c966e621cb69b4d3ea19b3482c4bb406ba97dbe30fe020d2e789b6aa8a012c94800738f1638aeaa16b7e0d8a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1ebe97678592d7df55258f8a713abc3
SHA1fb4f7f44267d31b999e454b8e57a3a42a825132e
SHA25654d8cb9d765cf144bb2a4421dc53f3919fd88a4f07e273a96b496f7eecc108b3
SHA5129a7273952854241a489dd8774fa9995c4b85aff29019fa41e7cf1cd9d9fdce2260855f981d8f8301303b16c3294b4392807dc4c2d1462f519d783b5f84e4c65a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529ee13d6587a02752798394a73797022
SHA145c2aa96ad27f5700a6f1ddddfebeae6412d4264
SHA2568739c587940aa4c0c391e71306ec92ed48940fa85a4e4cc7be436ec187d2529f
SHA5129e56076f997e3e123f6f3b854b3e29754f93a8404206b65b35d35d22072577b6cf5da3793994d0a56d3dae56a0b54d07fd8e326274b7f92f275f00cebd2bd86e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf89b2c13b68c3e7e635ae89a4911555
SHA1be180fe565330891b3ec48ea787909e398e0adca
SHA256cf49dfdfab025de279ed2578ad8b025461cbb824377b1f0b67c1a0ded5bb3b47
SHA5121cc44de374d09844a1095e51b2b9f241c1231e745cc5cab13324deb568deaf6989113e6a72adb1e13862be7de8a9109c1f1e2bc624228f8f6bffa4a4052bed93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5631a223e1f8a66824130c3b18916a32c
SHA1bccdc34e17a1885c5012700d24cecaa93d06c452
SHA256e019888658e893dd87f824975bc044fd93734912a45a85a24749bb01dbb2802a
SHA512ed24d689c1954902571ef6d393e257497a10d2aea2e78449e446de63f3076fc67fccb26d1520a574330a2d5f389d955bed1de3a663371821081c14ce54cf4160
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4f48434c8759131b1432ad60b77016f
SHA18c42604c5c70ab8b05655d21ad69b465d1c5dd95
SHA2569f9831874823db6868cf3b0f5a54d8faad5126895d7165525582412d648ff44e
SHA5121e4224648ea970ae041d673f2f49a275bd0bcfef7b6c9f0cd9084938a3a37c747222a4c4283f411f709fe1792e51990db62caf8a9593783f7b71acf41d19120e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d6f005a9ddbabc8f9c20304a639809a
SHA16443d3eca4f8d99f9a0c11d909f64181bd940e21
SHA25622ea8b616b3b9ed6a576aed31420b610cd9393e6d28c7a1d4e1382616413c98c
SHA5129a3249e2b64d68480df552beffc6b9979a24587a02a29e12abefa75b0a8495b8925187491cc5b90a6183028d68f940e434883cc21fcdd0ebedcc066033e34141
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d5c5d3d7a55c37c8a33bbc471b311ca
SHA15ba486667ff3ddfb03e281513b9888c77bf263a1
SHA256a44fcc604f430defc31cb400575e0fe0643e95710800a4ec4fb5a4fdc869591d
SHA51284101716286556ac16d3712dcac7fdae6f60d248217d47db7ccb66b622e863a14d9c202e058f419ecca0dc160efc92d568af9bd55edb01def4c942631fd667c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0b63b89f79c7fbe550ed3f18d1dc7a0
SHA135a37c5b9cb50551430bba3fc96e2947089c6095
SHA256a44304c976c522a3b78e2f2ec92293a7a2bedb97cd8bdd4d3b48d7f3a9939091
SHA5120e482962d3fab0a2e4805f8874337e67cb2ab8b021cded5de5b3a381c345c1be749ae3e8e58193c1a7aa9e1ce77202e4cf1d057367a92fb76dad93a2f580d8de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2e2167c527b30e84604a37f7e39057e
SHA1e55194f731419bddbea083b0a60f46c56d99c18a
SHA256fc643c18309f3c3be1e64a375921d09ef696b74115697818302681779416b154
SHA5126d6dc76d185425515337f76185b2a09dc377b4ced95a5919d1a191cab22e54db6e8c23fbb69fd5d82e8ea9fa17d5b6d5f78f24a782e070de1b0de4dd0ea9dbb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521241967d6f0ddc53dfdfd29490d1195
SHA19024cd581d883fe3a95853e2ed200dc351641485
SHA25680387b98c4a59ccd66727de570c5612d0bae9e76f1a46cd1e8e1284c859f7fff
SHA5129a801556f1110b00306aa6030cda96e62dd3d13657ec1dee55dc2add34b46fb2a01a00a963043f01f83b3676c250749534e06a257e9ed5fa1ae76047c27cf972
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e641cb77dee31e7e2dfeb0b353c3a744
SHA1dd124f7bfb119c63c5297c85e3200792f67583db
SHA25621496aa44b6513123db570f13bf78dae8d2fe56593fb0f090cde04427b98d30e
SHA512a1054f1003efbcddcdac14fbf1df21e715e44f6a9af1ad2dfc3251a1508f18e0fd8a3b0f829aea61a122fac345cffe27c13ec929c0e05996af26a68978bee864
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577ff6489819dc758ff908c453f04cc81
SHA10fc7f3f2199a3d1429f05e4b7991fb77325525ba
SHA256abdf909cd28987da62ffc48680adc7df902c5f0c2980babeea157d7f0efc2f45
SHA51271dd775067c8800cba2c73f3810e7d5e5137303251ac3175684739788a90ebe68df0c49097dae1a2a5ee2e4bc603dff74a5a1bd825bd66080d2ce7970be018fe
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06