Analysis
-
max time kernel
117s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 07:16
Static task
static1
Behavioral task
behavioral1
Sample
a14399b7c185b822c97f64b428ecb4a8.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
a14399b7c185b822c97f64b428ecb4a8.html
Resource
win10v2004-20240221-en
General
-
Target
a14399b7c185b822c97f64b428ecb4a8.html
-
Size
4KB
-
MD5
a14399b7c185b822c97f64b428ecb4a8
-
SHA1
b6472f222e52bbd3992186425c961138755c4d86
-
SHA256
bdc2428de67d013c20ddb5c4cf2029ec9be42c71abace614dac9613db86a2f07
-
SHA512
e83ab4fa7a88b73ed1d6aa2d294a45d811dd3c6edcb25aaec86636006a99571554da2399f2d9298a059a8b23456e9a7298cfcf8501e9172bc1ba29d0ade3dbbb
-
SSDEEP
96:JbH5zFZ883QiLNRqE6RYqlc3wf5m0bxLMC9FXrUl:NHNF2mQiLNRkhFFLY
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94C3F231-D2E4-11EE-9AB8-560090747152} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0885d69f166da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414920841" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000394d2f01a15fc9f4e19f07ac13da6e5eedab369762396d1316c237da996c1e0c000000000e8000000002000020000000dc809e89e5a2c697f6eb96a60be9d2abc202ed23f4f0e50c00bb06caab13488920000000fced90a78791f57404af4888726f9ac6c1dac4908f8c9b0f048a432e2a231439400000005e4444036bd56870dc22811fca7cc7e882f7fea35b09a76ccd32689ae3efb1186166ba991357b8ebe3236310a903083b9eec7f7ad5034eba34c39d674a4f6e83 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000001d68f84ccc19d315dc18f613e904cd7420275c7705f3c37f6279390191a1d536000000000e8000000002000020000000bb358924bf66701090b0f66f7d937060f1a6e7dfcf95b1061ef4b82cba021d3190000000e9aa684ed7d02c77d0c489d8f3d0a537f14925a53d7b2b1e2267cf96f386ce4e737ee94d1eb44b74a3f82ab666d9c841857d034e5c6564f0a2c3d228517ced303f185defcd6e770f43b1074fac6c1d3641f1a08218cc2f7f1a95a5b73aa2237dd118f8a1c43df2587c92d7ff912a5ee6a5c73fb04daca30cde470531f4e84a07c80a37429561529eca4cc899a6ba3edb40000000687faba95f285c1256a034a40901492d454215fb4619ff410539e1dbb04bb470857e138d88040a02cb7b6e127bfa34061bb01f380214fd78a1d54f35e2a4a18c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2816 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2816 iexplore.exe 2816 iexplore.exe 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE 1384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2816 wrote to memory of 1384 2816 iexplore.exe 28 PID 2816 wrote to memory of 1384 2816 iexplore.exe 28 PID 2816 wrote to memory of 1384 2816 iexplore.exe 28 PID 2816 wrote to memory of 1384 2816 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a14399b7c185b822c97f64b428ecb4a8.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cfcf87d48abfafef9be972fb0a1eb07
SHA10e463f72abaa6a20a9a58e4bc3b2149b9924f93f
SHA25614973fcfaec805e69e1a593b7c26eeeed81edb1bbd80273df1351589b3d53df1
SHA5127620bd217378547a60d02a7231095fdeaab18e21bdcd6322902aae5c2a0848c3091c77783905240e71512283846a795c39fe9b050573f3367164ff7fceebce3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5103ff85675bc660a5637b8794b474870
SHA1292d2477f6433cbc0b84754f90463562c7ab4c05
SHA2569cb9ce3bc02dcb22b1c2a0f39fbb328c528bfc06bd28c152bd0aa68f75e865db
SHA512a69a1b6771a0ba83425e884be50e89b1fd0e0b10ff319f7fba677c65a762d82c7594cc8fed7782f389ecf5850f496eee267d0dc680e2822e854c5fdb6126e97d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c87a2dad1f50f9d5bfad93348cab2006
SHA1adb3366f81215070bd3aceabfbf7833a251aafdb
SHA256a7dcd7c1551504eb107ab3c2f4d2ba6b772f39dc443ea8bf6be131ba2dec7c70
SHA512aab0279d73a4b7849ecf4cc0b7056b53e06702e3611945fbb946edbbc8155398c950c948f89e739ace29bd42ad4958fa8d44749c29d839161bbd50f1ebb033f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574f8e080e8cd7b2c014e95a9157ad936
SHA1aa0d7cbaed7d3a46a5547f1254f569d1d4339d2a
SHA2566d8de8689b819adfe53881e97a20ebf206303a22221f52a37b40a78c27895c5d
SHA512ef342195512c68bfdde25326681cfac88c1f9c2f30e278162d2d5847c36a4d700a81a4f43747b8a4194747deb2dd33dd30f1018dcf158d7ea5d2110919ef71cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e4ed9133b6f8e44dc14f38401b3f843
SHA1846d98d5fb59db382b50565bc1c79e6e52bed899
SHA256e343fb138bce0fb2d6434c03b5914efa5070d9981de362962cd745d007b3cdf2
SHA512fa7f38c73331003bf8ca4de8070344f1b7c8303931ce0615640cd1696fabd82d4e26ba69ef3885979ab17639239d261f4839878ba1dbc21729c6169face96c6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541b0889fcaa598e50fd73f1ead198760
SHA19aeb080f30496ec90b533658640f140947429272
SHA256794ba6ba9462918c984d44a4d1f73389c1a04a621e991c4447a9f2ae5caa217f
SHA512c408312c47fbfe19f074a5c0566c2d179e004cebbd266eff34c82633d7d14c65706f48e3ad932dde2077744da0628359945ac0fb6cdac61fb9bfaa532bbe837d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d374da09589b4cea3b8eb0203340575
SHA14162b191fc42d2c7cb45155ddaf0d9c0a2dbb967
SHA256c003bd9e12ff06e6c1e7ed3913c40c384d1201451dd8f8bda27dc351b360c311
SHA51254474b28300c804189a857e62504f8139c1c886c8d65da91418f12e322404088336726c1b74f2276612526d4dc9df2080c5fd4b742da6cc831b0a386d9b6aec3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a0b7abd06ef90c909c652031ae98b28
SHA1512935578a4365d1b9f091df16f0590c3da31be4
SHA256750f89208ca270cd90e843dcb5058116d60ddb41c8688e7864dbb690573b193f
SHA512160ea82c1f2e807ab40a05f262449f8cf88c50cbe6a478782c0b71654c03b26d428993c1778c0a0943917e2a75f23ae4d2652d95161c3edc95363db2b8b74435
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6102f56c7dabdce26a12e645c87a709
SHA1850cb30c300d4d75d6b4ac7b99d44ff790170287
SHA2564de124260d28d78a71961b8fad1ace358ed01f2ca7f7086c03b86eee17bf4a95
SHA512fd1185321d6d455ed9e83e19b8ddea3936dbfde9a80d29e08b3f3cc2bd05b45b7027a937fbef8268768dde0ecc945e95827a2985d8ef762e88b9c8bb04d8b47f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a64dc5a7eaf82aec0967f9dfde1cfbe
SHA13c29720584d20e8d32f1ee53a226bd8a1318bcae
SHA2561b8692c517a6c3871e09638e7957df69df0a0623bc4980b97a0b7082afe56245
SHA51297a1de63576cae98236dd6861d1884352e39d924602ad67d0ff5905e4af351dfd27a783b1df9b193594d040912497078f22e928a31665da091d924bc83785ea7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc6dc860ab77914fb35bdd426fa1d746
SHA13c26832505cee61929cf92ae3adc665ad9e6a337
SHA256bb1ed5b766b96eed4a7a18beb34c59de522ece7804796f4634d929741cc4f537
SHA5120bb076b83139fb2df0b767bd7764b6169af5b36eca598f0be4c693de366b5c2bdd0c22996b4d4593689b5a185c09d72817f21234a449d35af43d6be4be474645
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de0140ef6d47b18feecb59b63bcb0d3d
SHA197ddb25caa0846ea00afae246a59f06f7b495c5a
SHA2566a515b008c628f2bb5148ca666c589450dd7d52c2ac320f5c674373ea6d9854c
SHA51256a5668c7e3e9fef0012443577346edb724a004e5fdbd9e4acad5741a8b2731972bfc6c051b3b28ed958ea48fe167306509e65d5e1ddcbd898917d1b7c87786a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06