Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 10:23
Static task
static1
Behavioral task
behavioral1
Sample
a1a197da513640f16c90517e0368c33a.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a1a197da513640f16c90517e0368c33a.html
Resource
win10v2004-20240221-en
General
-
Target
a1a197da513640f16c90517e0368c33a.html
-
Size
54KB
-
MD5
a1a197da513640f16c90517e0368c33a
-
SHA1
535ba3dcaab21a0628557fb51e30f2ccbc3617a3
-
SHA256
ad5b89e47d2c49252278ee8362e51c94ad2e41f4cd5e5f4dced988d157ab39be
-
SHA512
40a4f4fe2251aa93f4aff62525bccecd77f8e637fae24fb3fb74db654649d00d68104aeff58cc61ca6a8af055def179ceb5c14a0d9ad3905d90e526cfca14409
-
SSDEEP
1536:FfenECCuO0LYpNtXe5WWkXd3UplUVcZr8:FGECCuWN6WDdUplUVcZr8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc50000000002000000000010660000000100002000000045702df84eeefc36b23080fc7c8159d54f14999daae36cc45b33152d11f52a3e000000000e8000000002000020000000fa6fc18a640958ca3add35dd57ef2105a986d273acf42667dc21ac422d9c0f6d90000000a23fa59d93fa41835f5ade649f59eff6e5b94b40e9fbb4404dcc97e13ade54f515f7697514fb4bc069ff4c88ac25158305433b5a2eac74d158e2f9f87581ec291f1904a6b5de8d1db1bd94ab6f72e2f1bc301737140c81c2cc69c8537391b4fb11dc9fc9b3390dbd655a5fa835c5e2874375f4aa074e33fcdc963b4e1d5539eeb193a98a3cd795a179a422613d1ea8df40000000a48600204e58a0f88e460d1d7adca21f0f371eb4d03c30f85bc481d632cbe250bb6af62b72c078cc485c83ac1a0f5745a6f86955d2a4c1847172aade8ea07ddc iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414932101" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e06ba2a40b67da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE5F2C71-D2FE-11EE-85E5-5A791E92BC44} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000406b03e7b34bffc02b688e733f98d08e2463fda10e9343cf1f1f73e006e37608000000000e8000000002000020000000fadab23b97b740f342bba2097c9d02322a735dac0d0607a32369207d9186ff7020000000624cadf906ba9a74f65865ac24c91f147d55b54bc00b6f45c6a2fb4261a4edc6400000002e0a4c13410538e25a402aa3dd3c12cf5bad52edd5a936df93e72bca6de3312924bd4467889e8c9f2caf7f887945e914f7a136478079c0e76cc2548e90596183 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2176 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2176 iexplore.exe 2176 iexplore.exe 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2248 2176 iexplore.exe 28 PID 2176 wrote to memory of 2248 2176 iexplore.exe 28 PID 2176 wrote to memory of 2248 2176 iexplore.exe 28 PID 2176 wrote to memory of 2248 2176 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1a197da513640f16c90517e0368c33a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de829411a5283c3ace8b07cb0e258e15
SHA1fbf1dd9c17cae34bdb9ba09da3128e2b4e8c7c69
SHA256c106ff65a21d5667e06da8dd2f01030d28a7d486e7a235de3069d1f2a19fa19e
SHA512aee04b69442893bfdd64c11c5d1760c37e858904a009a0182fe1b7707d4a0ebe31b545cefb4128519da5471ccd5c56456c8cf3e840d366edab3f69a120b810ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3bf36b7aac9ce8f8146fb2093357b4d
SHA1f3392ad1ef9ac4cfb9eaa4868f0f98faabb3d803
SHA256de5543dc25c110c805164340114f7e8f1439c2e132248320a1a9858f2ab41dc2
SHA512a5cd362d1beaa6594f49e4951c8c3d99d8837073e4381f862cc0e14d1ea6592f03dbfa3b8972bbe6c58d71026d282b3db5b400b30d8db1fd40322439efdd262f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5944570e966bbb75ca112971904958533
SHA18bbfe917feaeff777c36845927ad2b4aa052c582
SHA2561c0435b7f456485d7085c8fe52fb429498855220ba60f2baceea220eee727f06
SHA512037376eee2a2f611b3c1686c326a52fc8f6b5b8223d28c3ee917db58e0a1c0dc03d65c0db2d37039155ea327e47321879aad12884964ff1c78f20d13a1581f49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5672008b81996ece6df9299ab7d71deff
SHA1060cd2f0676ded6a2a6483bd098f13489321cff2
SHA256e2ba667c3a69af11c73ac01ef3b3e7c55e72e282e0dc4a319a775e01fdb8d9b3
SHA5124d690147c1477caa88be1a17f7d36141c42900c5a2948faf6fc8d91e2053a9412dbdeff02882f4b0fa1653cb41c4a6bbe4e3ff870a54f710a5b4a1f7d5842d43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5803ab90a26db39fb73216de1538005e6
SHA1b2a438da3c414499808bad8fa7ce5b0514977726
SHA2561c7c48a608a6e76036e71a9ad7dbe81974bbc4a4b68bb0ba4e7a739e3b753c7f
SHA51272700771beb316699d54b32e31c687916db60582660df408e93ccce2e03e3c02fb449272b03be21b7a5fdbc16dc5abd108cf6be84689532c86c0414fd817d6c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ccab3f43ebcb2565b89a0fdbee40de8
SHA132cdec4a7e857973131b0700082ed087380772f7
SHA2567757bb7fe0f8f44e0c9659d1abd213da606a37c029f2ae351c3815df40c498ea
SHA512d7c3bdde24f4082f478177cfc8388598d820b01587ae8df525f81fe93a24962b5e3235ebf2c7e5c90f6009f7397a3fc09183e48c0a2bf24931ce1d28cb0b70bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5495741f84efa446a64b4c98df0f73639
SHA134bf68df286073b05fb736a76fc374a1d51bfc21
SHA256e5f57e4a5b2c01d871233fc0ec136cd8334c9cb4537a2ac1c708d9574e9b4232
SHA512925abdc5a6b37b2222e9a9fe2e7ca61b5e16f2e5c22d06ec44c669339c0f76f016b1c3a5cddfe2080b9200f8cd650e2e445bbe851f5a008ca4e105f357a0ba3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b32fd7b59f90f3fc6e103a6070e4419a
SHA16b9d2eb3c2482e03b2ded8de6d1287096bb5d659
SHA2564dd5ec5435651d13850a482a667ab97f89d29a06d5b45d7dfd282044ed26de23
SHA5127d94c6a18016878d11de20dc1b22c2b27e3dae9df8cd4de88e8e2d26f6c45a09ea489ac2aab0dedeec4fc341c2497c55908d8f990d40a1e1c34a1ff76564557e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50067665ac67cb3b5114430be75cbc16b
SHA1b5b7818c331ee26737977baaa532bc17aa436baf
SHA2567f10f807f862317f40b1b4f7ac0f366b040c1b778a59a9fac9d90659c1e43ef4
SHA512b4541cf52cc66dad7ea5458c8bf4dc5e6c88ec5f34b65013489444b4a082896d5ebcddc571e36b3d52a4f785f2501e87edebf720ba69da82c0897b3a9a7699a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537d801c7a86aa64a4b9301154e773ce6
SHA11548df6572ff80b14d91f543c627a34ea4109da9
SHA25679f308f9c8acca28fc405438e8f8cb3e12561f275cbed43869fe9906f02ceaab
SHA512c9248090375f769fb0cd391a909d91fae07a2bade29483d9175d32a0aa45a93bcad9bb83031d47f2c11418dfae809223bdbfe32374cd7bcb0c6cece6ccb66742
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f312d6704639ee3035714086aff96867
SHA13a8ef004d01cd91eca3117932da86b56e7c13a2c
SHA256255a102c9a9c486700a8da4551533f2ba8ca75bfa857b9873cdfb7d0e0fda8bb
SHA5123b289318c14adf9e11480faf6d89ddada9ef2a32a76d7a933bd5dfc9995fefe425f2dec473e31682038b9ef07af9138740a430bed4cc31ac219a47ade4bef90a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5016db552229adb990df4e6960a12bd05
SHA1f473b3900a98fa114673af7615e407fb335be33f
SHA2564125da9693eabe1c88df873bb72d5b6c7a8ceba3f8b2b9bb10b33e9528a47925
SHA512e0c279402a7486f9f59443dfd1afea24ee2608b2f416fd6f4ac530a1244b30a8b7e6bf6eca54c628d169de0ced05d9739d5bab671aab8432b91105cfe77749d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ba7cea50509dcf618f2792281c6141c
SHA1332ad669dd7e618f4bd067007cd0e2519eeb90de
SHA256a88f2b4efa41dd79e1902544b8a30b71b80aa507ab4603e16567ea82c58b6e44
SHA51261cd6653927e3c5354b7a3453ac29ec852b97db87fd1ff175caf0d162676572efaa8668815b83db2b8a5d4fc7a662a7c0ebe00f5f463111242325d7d7a97bc9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504a81906b2ebbc0084001b440146b1d6
SHA19f780cefbbb76ec3c13ab56823ec4d79609a12ba
SHA2563ec08ee421a1136ab8e4a80a26b680af5678a3ff180c0e5fadddc75fb6bbca93
SHA5124013f23dff2d83975e09129a8a833d3c28a73b383fec64d4a55b2c3091e202dd6706e1dbc5cfef19a9a0fa7614ad6a10a433e3e48639414150da9defb5d8cc3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a872758940e7b78654d7724046a7e0eb
SHA17bbec9343687a31036e4dc4825712fc3ff74db5b
SHA256121bb65df2700d389d537c4146deb8fc4e298e62a71554c701d908772c8ebf1a
SHA512c368f52885fbf71fad5458e100ba7c25b26b983f79f16fa2a2c9dcb42325872937f9c5e59c4029fdb68e84c1c62be703365e064b5774ee769b19eadc6a920b0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6364917552714505d808e578332c6e6
SHA169719eb7fdadd9206ce14f72f0f1862cde381704
SHA2560014bce179e746516765584175540cca5c57bb40436740149d6ef59b38cca65f
SHA512ad64b1d08d99fb1579e867d3f04229781fcb01e6e780be8d191aa69fa12c549821bad9951729c283d24a63c3622135ad8ef9cddaf65f1fadbc5791977ccc9311
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bd1f23723e3ff7b313f91bb72c88deb
SHA144bdd72e63417c741816fc7929f708e20fc801ec
SHA256f0bea77154e9de9c0de0c3fc3617e9f95985e443221e7f70e7f8d5f03805b49b
SHA512d78baebd2d7f75241429189fa65ad34d67f0c2d8bba44aa98893fe77e0db1efe0f95ca4e71294cfa4c7910400c5b77c3e1651a50126c68b80948253f28a458f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3fac5081d4c34f9c891e8c68bf42c72
SHA151a56bfecd9fbf51370eb87c0bbe630fc442d6d8
SHA256ca248ad1fbf025ba2994a0b47c6ba72e8f1d3c463bc9cb1f222e47a536e66127
SHA5129a1610827d570e7dc218feaaff02258093e4163ea20767acea4b003fab6de7b31e61871d9a6ef7d030a63e20a541e1e87fa2cd6ebff152df80559861dffd860a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06