Analysis
-
max time kernel
1561s -
max time network
1562s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21/02/2024, 17:36
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240221-en
General
-
Target
sample.html
-
Size
18KB
-
MD5
9942c502136e7b038e802f83d20c3ad2
-
SHA1
ef09bfaa7f7791eb66d238dbe5603a99519c006a
-
SHA256
5e74098c5293e636855b8af94f944a36e810ef492be60dd92dca12af5b3ba575
-
SHA512
0b937548f1122e1ce3314d41a37f13cd49ad325a3051b549389dad63527896b6f0b90758b317063e1e8c23cf0dc16a49e23e6f6450399132aad25f415d3bb767
-
SSDEEP
384:rnSaDpmReVoOs4fN9ylKeGMvU8HhhbXmQ75SN2weUPNVJCBXQL:rtBVoOs4fryI1MXBhbWuzIJQQL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414699044" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E537081-D0E0-11EE-A296-4A24C526E2E4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506de902ed64da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000068317833d6be363484dd98b74cd782b3ceb1200c3c8df5a0813c45a0a2719aa7000000000e80000000020000200000006cf139b5cf149f66292e39fb2ad5572f41538f4c5b541c91190ef42bc4215d4f20000000e4f8ae0a4799571a5b4da4c5c7e77a9c69aa471afdc12ff8e4c96cde90c4807b40000000daf2db10ce621b5fb91e700ed7e53d905a845cbb1326bd199fad2afb399ccb72ec991c5a2ea3c9f8fbbc0d786bff756f8e9df24859c6c1f1b0286a2dc2e0f1fd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000c698f905655a766f789ec9ee609691da85d3656ccf628b2a62f8cfc6b7af10a6000000000e80000000020000200000006c3bd1995ac21e691c6fd556dac595777631b888dbff5e356f1e33db082dfc1d90000000b2800d25bf3e130013d4a97c97a01135ac40a8531002047ffc5157d1676531664f379c4868d132e98324342fd5f8ba35231e64c1e4a19690390d4370fa275b97d87cb562dd03206b9818e58c7c1f0a16c05d350a3a4fa6a67bec2b47679bfd065f6834bd4bb7eac6981342b64b06d780d51f12b66db906aa537c121a53f22b849aeb37a972439fc0262d6c2d7d87f1ac40000000d3233442811d59010d8dadc06166e3e957fd4a7e3b0fef5ec5be8ca3043850f4b87287c84046fbac1c98010618a50e015f64d6cd8170efd89950aa173c71873c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2268 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2268 iexplore.exe 2268 iexplore.exe 352 IEXPLORE.EXE 352 IEXPLORE.EXE 352 IEXPLORE.EXE 352 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2268 wrote to memory of 352 2268 iexplore.exe 28 PID 2268 wrote to memory of 352 2268 iexplore.exe 28 PID 2268 wrote to memory of 352 2268 iexplore.exe 28 PID 2268 wrote to memory of 352 2268 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:352
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50898b738acc453c327147c09d09f3502
SHA17365cbcca8c6eb05a20611f56819cd5435941b84
SHA25602259bf46634cf2697bd3c9cb7eb180b2e140c2481fcccbdfbda7e4d86450ea5
SHA5124ee9a5cc7f8fe522a10ccd39b45e96f8ac1c86cbfb2f29adef03e1663d677e0532ace405017217c1eb5e117c57b9dd8b4a4a4908dbefb95c08d6f55503e13420
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556ef07f6ecb09ed0734c15d3b3ff5ea6
SHA1b5a98b6f2cc6082cdb721a7260aebdeb2cfc0ca3
SHA2560015f0a41cdeccf0f57b315990bab1963e29bba33db691268fc5a6a9f112ecc1
SHA512e0b610f5c1ab544e1f6ced5511aec74c45403ac6040648ebc17de88fde3ba3fbd380a6f0183f2d40f761d10e1b6aa0ff364265aeeb43ae5f9e1eb703e2f970b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576f77939cbfe7acd2fd90fb12d42dd0d
SHA19f680e6fe6ef3760df9838d65208a9585859b78a
SHA256118fa4a52f38148b851ef8ee7f3f91a9aaa5dbdc85dda17677cef2423edb345c
SHA5121cd92fc889c3942fb80d1aad387901edea19815dddec8b140bc2e48e0f929cfb68bf94f5afc2239fee9ccee9b94e2bd5ee01bcf0f7c2c5799e03ab52499fcacc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f2f9120e9278de374f6397c95b5f73b
SHA1264fcd1b2640e21065ea1afe50d73d12e71390bc
SHA25680dba827309eecc32628ba58a376f314cd368b0a34876b8d7d784f2b1f81bff9
SHA512add6d8a507386b17ce49b601c9577f80933ae5b0d41ec253b8cbe6de20a4feb8a128d2c1b7fcb2fa1b15bc774c08c0cbad927a59fdd67a010cee7c8311243d38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d14f249ad6944399b47d9fed70826535
SHA1c23f779e8446679c63b36d57beacf8bc3efc1ad0
SHA256294339f1e81c2787a99d498fbd9c147edee7cc52b9e4bdb8445727da7a252d56
SHA512ac4155d0a3f646e346f7a16b2785f383f062b5388ad88fbd3baa163c266d825a9b955a02104e68f4f9fcbf18f0323e9abf8d782b8eecf8be934d3c93aa50fc1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598935b8733f3823417c2d8ed1bf1bf39
SHA1715c97cb432baf89f06da35690e5fee95e23407b
SHA25624574476677ee9cded8ed11f912bad9fe7c35629db95ab17240d20ff6e933851
SHA512ec35f83c9739758cfcf1f6a7c7bba00db4c3bf007fd292e372f61beba64e277fdef2879fcd235826937497e254c154aa09168ef6052763f7a850a6dbde3277dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d25d14947b0a4869aca40c80b677737
SHA132a3130a87f792c30802fd3853734e3c63c48e7f
SHA25675f0a78a1349de3dfc522bc225d77c418f75ce169569db769acbd650da07c216
SHA5121f21ed9c9f6cd9e4e7c4f254baf3caa9b10766669139ec9f1b3e07cc5be295b51d2f3784360da85457b4d1ccf94b3df6bc35bdcd22a041b4fe2fdd73827b22f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544de393c2b8b08a56b790f671b3cfee2
SHA15c04c624bae3b00a0fb391231fe12f7d8622d906
SHA25600c4c750a4b3bcfa7894f2b726abae8f303192805c7b3abed01d726145048d6a
SHA5121bfa50dae52d557d9ec074185108f387199982f3d760cf5d5d20d76b70c8279d1fa52dec155cb748796d89876d6ddc84961ad66a03ea982515fc3052b260c58a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be9e52610e510776a4c759baff425cd8
SHA11824b6cf6060547edd1bf40a8bcbab02ef6382dd
SHA256fb5ee4ed15cfe2f2da58831d848bd0f430cb0f5c9e3f03f3e25dc0835b759c77
SHA512570c91d6eec160c1755b5a467de85757b8bc382c0c8a28208692a6356bcc1ac3b166a7a25647cf0c5721d9ea8eb0684009642476667725fcf682cc56bbe91fc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59761caad6f3e4be2291bfab71c76ada8
SHA15f4b9de92153d1082b96a7eed8b5d7a9442706ad
SHA256a4c8673a5119ac686c38aa2eba917b4528d98854ff425199a51c1d90228aa85b
SHA5127b04b233cba1b39cdc98e11b432ecffa3b606561cbc439b2ddc02aaa98b84d535c31d662fe58f789e6fdf068f7a69553194bca9f5ae8502edcf779c9b11f91c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548ddaaf617dd9cf06942703e8a059319
SHA159dc2dfac1e139c85c8dd56fd64f86616dbe5905
SHA2561b7d04bd93addd5ee8ad98668b8f9feda94f4164b34c3e1eaf8e300d97b2e4a1
SHA512c02d2d015c51130dc328733ef42f8d4fc0523dfe5774a824e026a454ac6225526d45ccbfeb911d5dfa50351d13d53e3ffd8f52f7c3da0e494443d24beacb26f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd052835a6f32b899ef89b8f479749aa
SHA182ddb2ff4c89ed6a3efa7dbe913437ec7753fdf7
SHA2563a7d4beb3fd414abfe5a820d37f5bf40dc04fe6d728fe7f1b8801192ffa74722
SHA5121c7033b98bfe291e4f7ea63d40a71969c01318958607fa36c3fb63b21696bd6417f712555d1b195eed7a5e82da72806da9c0dadac5759ec93b542318b4323233
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520a1dfdaa12f25c4392c352a46999e3d
SHA128dccf2cc135de4bb2ccc2f8c751994978d79534
SHA2562069410fbccf6076962b13e0c91463b772fd603c5a418a93744370526d3f5999
SHA512bc994b554211f84eafced86346d73c7438127b2c9341ec1df31fb79a84f661d5c8b8003a6d94c2851245f5eb96e69af07281081c6c8b66b5f79bc50f3bc981b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac7e6a671fb85eec986406a2a67484dd
SHA10dd46fc2803b60bc35318ca388c424e12b56afd8
SHA2567b772730f189959265c9227494f7849d6f81de756872032452677cda0175bc76
SHA512b4785f43464e8648a1188c89499dd5aede2e28a02fac63b90f2c84413334d46c99ff9883a8ef5b50ec85497ffcf694275444c43b46cd71921ff2c5541a98ca32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50053538d505b05bf130fd8ab3601e1d7
SHA1da79ad3340166e9e4d82dff137e6834ba31b2ac3
SHA2562fc825c8724f4fc9e6d677ee567f1e729daea3142e8fb77946be42c33206cc04
SHA51208f9bb8beb9780489104e64b1f0bc8a35c146dc91129e218492d3180033f3cc0a62cbd0839f6c9c15020e8402c12ff896ffca2e0be8a7327476785b38a23df5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5870de1f329873c592db183e50d799f2f
SHA144c503dd72e5da3065898fbe87b5b7e69fa412d3
SHA2563e09c7c247939e10b5cf7cc56b84655292ec8f6d7745ef81d1811f145b427b04
SHA51291b679a2e20f39b39b75e078c938338d32eaf9c38b734ca296ff4e3d3abed71edd3aff0bd4e37aaa8c5530f5b1201e95ac6d9a4ad2a27a976bea72c6132168ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7650406c5cec03332fe346e98a6e190
SHA177b757776801e31bee06486cddd2812c5c4f8ccf
SHA256d294e78a2d10b12ac602cc0657b2a5866d70467d01dc95c074fc26e2d6ae0da9
SHA512d83c1fb48559a707561e66a4bd15140decb79b4628a663ab2c693e5666dea47609f277a60c41783bcab687f1058246756d5a92c7688f0ea94fb6d3871e505b10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545f4cde78622f8a7b99d58ae88b1d459
SHA147321fe431cd018f1a0da7bbb759748b14649a3f
SHA25666b9c18fffbf2a3dc5ea2db0c30fe81898a87b95a1879a0bb078be4f421588f6
SHA512a3e6527ad022467d4d319c0bb09b74037b6737eef652ae0c326562456ccc4865e7c46b9f0371820efc0259d77b499f09364f9e25ac9ca37e19fb9d636ca1f600
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5906cc9037e6f42621992f90f28c15524
SHA1f38b3012f565148fe2bcde4267dfce245f91aaeb
SHA256166a55db8b36d9916346c97eb17c033d03e533ce14252bf72a8add4ffa994a28
SHA5129c9f82b1aedd1f8e2aaace41903614c8c9828789e9dc5a0307a4c42a1876669728a670be1d98451c5d8dcd05261cc570f7ae886684c23598d95c61fdd57f6ff9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06