Analysis
-
max time kernel
118s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20/02/2024, 17:56
Static task
static1
Behavioral task
behavioral1
Sample
Novae.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Novae.html
Resource
win10v2004-20231215-en
General
-
Target
Novae.html
-
Size
16KB
-
MD5
9cfb744b8901775053f4e0daaa9fe4b7
-
SHA1
48a04a51a47c4166cff27b4cd92db1f2ef8fc25e
-
SHA256
57be770ae30ac42a8e5e614c22d60d295bbc8902c4e7f2775edf7890c5c2cd19
-
SHA512
730e28abb55650dd590e93ce5895755891ffd34965fb60df833726c899a9454473673f0a715b63184d842d544dcc1207a402c4397b3978b079c16857e561f8b4
-
SSDEEP
192:PNx5Ssv99qXoqTJkNr7230AzPz2sOPwGz79uXMuHRvM6fTYYcxUfcy9zZN:5Ssl9qYoJkN/rHwG9uthL7TcxSvN
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f01db44f2664da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414613703" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79E84101-D019-11EE-943A-F6BE0C79E4FA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000004c68984ed325cd965ac810a0e34d93da5f2169d904e77eb428ef99e04bd9a365000000000e8000000002000020000000c4cb3f3cd5799b488b0160c72f9096efef0e1b5b8b254ad500a4cabe3c13240590000000cda3bed77e947834ac433848e90f1e85c489b99177e5d2f5442305cf3f500024db3e1245d5cb332de54d95b4813f78d4b153591465347696a68454bca99ecf276ebc19f2e012670c5164ef216f0ef405f78af0a8f4891f2fd95123e1196361c8f6ad5f6a95d86eb9c2cfa42c42610e6efbd0f005e20203a0127d01589eae86f6a88cb5286b9d5171f0dfdb39fa9e90d740000000b1802c5af2630db9815bae1620eb01403170a3f03b3911a38363dcfa7c5ee9fb181438b0f18a8b48be7aff8d54a4af0641f20609c1065b7f905a0df60f95f8d7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c5b805fec758f01be8095ea540d781a2dcac759acef561b4313a22039d90ebca000000000e800000000200002000000075cd37837d644ae26073e32088a85e438c3403ab17e6777cf9d1fef384fce5ce200000008932a5af57b8a95e8a11d2129290e77670d24b86c4fc32c773b19a29355507af40000000762832f15ee8440a541c4d3df96faa8620abb9a5b9b79899b8986cb4d5a41937f463826c32013f5b8388facedf75f036736543ab852619c4d0985d749846c23c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE 2812 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2812 2184 iexplore.exe 28 PID 2184 wrote to memory of 2812 2184 iexplore.exe 28 PID 2184 wrote to memory of 2812 2184 iexplore.exe 28 PID 2184 wrote to memory of 2812 2184 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Novae.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2812
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab9fb785b5823df93879c32d8b76c0b1
SHA165f8a317af4a36e667bcd82e6533c118d047ae40
SHA256d43f7a02847a875d8609faf86603171c58ee1fc15c755da7e2e372c857940477
SHA5127bcf5d08aecd599d97acabb9aa5df2fb3c6b94605860df2dd260e86685c9c0f711d3db27f7df273c98afecf7f21d413ce3f7d69a2ff201eeba33796f3c285a21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a1525a84426821f0f50a23b9d6756cb
SHA1a101aa705a801dd83456c193cd83bc52fe4679cb
SHA256c9aac5aba3e6d308794c22de7a7e0a37a7c41223ee6430fc9313368b8fc9c7a8
SHA5127fbe36de06586ebd854f4346331a91644db95c31cd79266c815da3ab6d0cea535b9cc5b24ece49ac6ee2556213c781d51955e256b55c42d90b53c2d58a8091b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5637311ac9306ab2ac3ec7772e199a309
SHA1adb6c1da5a6c2bf79ce9c68c1fe714bb21387895
SHA2563e3a2930aa71bc650addf9b0da9a5c500a451fde18788751ce508e21b381bc17
SHA512296601155f1e89b1062f2f77040fc5383eb8d670eb919cd74da6447aa3798412504042a47cbe9f600995197b9e834074d82d41d369ddf329bc3281912a5272b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571fd0a158799228334ea7ab214c433ff
SHA17628641e2a5a44a58b61ffa28f4d16e0b7287a1c
SHA25683c752fb62b0fee8be73419170b356066be9437ed2ef45bf5687d73038606bed
SHA5129204b03b1cb5fb17bc4ac3c40fc073cacd4b44c42e5e2b1aeb04efe096ab756d52902e403c50e89ffbb7d17d10b34c2dd754ad3a0a983b4943b656190cd39e47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5167badfe863802fe1755322e430a7110
SHA1c8bb9acfad4347a11456014aa7e9a6107e8d3f78
SHA2565449eec1b25ff64e57044d00c332bd19fd3d4c723bda6032c15474fb00b96e7d
SHA51201f8324c5e1b7f619d8606dec4446b3b293f2d5b6e591f33207c2176a0e2f05e32d1aeee8603f1f9c850a0e4e6edb7ec7f43f96f052fe0cc88b1254411a632b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e68f543d9c2f2062f5eba085453562c5
SHA149cfce3b6027402ea15b58281033cdba2166cbec
SHA2560bfba7b6744fe836023e37b674f94687ea1ea879ab314b35fc4ac8cfe3596fae
SHA512214eb946ffb60707ab37cac3a69c726579e54e30311b9b98d95fb3f332ef07d338e88b201864c2b9317d979ff5c20c28546d5a84302aacbd8cfaee3cd181acc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568b170f453f59ff75b1c10ed4e7818ec
SHA19b9d386bf2e634925ac5a47a1899e114be87acd0
SHA2567b6e2f8372f9017c011e99140e0d5a1954f9329708b8b9bbc5f9476c6e076b1d
SHA512a9a4d756d4de49deedeaa7be219de3f057e05a00549381032474d8eba1e7ea28baba95523bc7fa648c09cd56d467461281958136a207d7086d86355d067628d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5496fbf6c61aba9c672486edc1797c20c
SHA1f8cad9b652dff5154d412d8ca2de3d823a446613
SHA256b6fff16b7452de296d31f7c87f17e6810fcf0474a9f1c504ce8fcc8722e4bbd2
SHA5121693da6d58f46f2ae67fb978df046c0e51d8d29469978260c29ea64a99416955573c1810e71c5c51366f1a20aef58a49deb5d63008e40ae5c978b9d9640bdeae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54245d07db4ece7ecadc1075df050768c
SHA146374dac5d91333c7abe175c0c93925f7fb1e98c
SHA25688a0976c90eeacb077a2ffea8923a9537c84a6d37d71c3d6edef688b490fc4fd
SHA512b19ca1c1bb1df3ab2a7fdcb22f85b93d2fdc8297325ec15b0f8bcb2d6fc0a19925d6f29312a4b9a810d43e132d3ae20153a4c7fd15e4e485d20e710539a31d84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542b228f3857f0a3dd8bf66eba7dc20d6
SHA117e4eea5bab70bee24d59eb22daea7bc0614951e
SHA256289c1106b79e2714d8dc0c82faf605e4fd80f95cdb168939fc756bc44afd64bc
SHA5124846b2716938862dc936e6f5e7cf2a3523c330ba87502c3e41b3fd4a603521216967ea3fc5e6ebd7feb85af786351ae8f966d22bd7e48a2f7199b7b4bd0280e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50eee4ed2ad3ab75b407508db2de287d9
SHA1a493a3e3e6ae55bfeb33ed877eef604333328171
SHA256e15c179b0a1a637c6f706418881955234db2789747107da1e401f75114fb36f6
SHA5124f8a773ea979614cca02567b1f5936825a330e855baa41c96c06459d1124ead8e19d5e60bef3f9bae74dee91a0821b03f83083e29b9cc8c50b1e19fc3bd9b643
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec893f13ee83eae0398297aa93d3c568
SHA172d6c701b0a9988fdfcf6e819f9bf04e2246763a
SHA25623f6107e3f2728f5c8294e823d1cc3771244f1bd23dd8919e048e09a45cabdf8
SHA5121bce0147a7435fa909334ef2c93b04f2c1cb849d699b522911143a35dc7f8f816ae5e44d5d03695042120a598f6e5919d1598af7a48f6e1bdec87d665518483e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fead7efbb15f3ff0621288f70dac8eb2
SHA154c679fc9678c134152044e7ee3dff0f3ee30d8b
SHA2561dd86dbcd50f207f982a42d9d814393b298d08d41e57255f55dd2274ea390045
SHA512b410230bb5a7e20ca3c9d84235ae2e0f6ac94d168ea2822b8dc8b73268a4aaa4057a118ce26050240f77f6953aad8b18593f0039c637a4b7adde82fb0482761c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504acf172a72d888019bc94af84ef655a
SHA1d2db8da669c569b877df3ba92155e13081d7258f
SHA2565830bae67b032e1ed8bee3c0aa37bc2aa369a2a8ca3d10f57e24e65a661a8bb6
SHA5126104a8c6100d2553ce230105318d5c399361f021a23cd719aba1dfe8cf55d9abfe399ba2c5ff60d81a4edadbed8cf9717796caad72ce2a4e4a2c89b0b419d2c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f268c001300a5ff6d6261388b1facf78
SHA1fd5eef0eea02ceed7447859fb83a3844d0a8ab9b
SHA256f092457325f6d62b42e4724c3d7f41184d68660b8b70c21cb3bee86caaae79ec
SHA512c79dfc93cea72fd4e15bc3362ebd746db2c1d4ebbf9a88f4a05892195447358e600cc18e924fdbfc93a686afbccc6431eff207997df4c07bafb6f9bc10140996
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5714103d41e9aedcc5efffb73b2da3718
SHA10c963e630c0fe699b9998a829bfbd1c64f91be2d
SHA256f3523994df9a18c9758782c66b76d715129fb6ef9877b2a2144bfa9e6aa8b305
SHA512ec96a280e7ab6af75ff4ed895531797455e0c003058c15b241631e0b7f6ce40401a71a6d512bb28a071456fda9dddbb44f43ef379a1b81237b1d232e1b59aa7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585287157c7daa52a462e8241f31e119b
SHA16359ccc5bb3568f4cdced10aa38cad56fd50b098
SHA2564a4c439be90a363118af550ea6fbf11d870808631c80d998cdb4447ac1ab194b
SHA51212f23128936d76ee30307f2188ed93959e84f61b3304e2f3a4ff42c55b5efcf344f365c5f56b7d2d63df19c62a4ab3c60d559ad5e0d878c85801f3920316859b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526ed49cb33bcb97d2116fcec1a66ea89
SHA15e2443348fd1189a6eb95bbd229c6fc835b389c6
SHA256c2cffd1287ade2108bb31eb08714f5a56e5c991626cefd56539342df9a9ad9bb
SHA5124c38da3f6a4e29534a0cc9ba16ae66e3feead53acb59b028100f9428767870efc14a75a26c67d4158ed9321a767eb59be3e18030aadf7660dab9cb05fb781760
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef71a357f9d11c98d94d9a9ae2375dc1
SHA191d6d5188f36dfd9decf4400698984f69185be19
SHA2560fa7cce05aad4897f3dd20ab3094a6eda6a5534fc6ae9f9a00ee0a1fb920d9e6
SHA51251accae2e8f5078f157ac423cc5b5b8585f6a090f7a7fac5aaa9f651a0f30d9482833ec758adf7f46cb08fee56d1280ed9c75c0224289e0c9dc0c83c133f8896
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06