Analysis
-
max time kernel
120s -
max time network
201s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-02-2024 14:57
Static task
static1
Behavioral task
behavioral1
Sample
a222927ecdbf60c58463c972739748ee.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a222927ecdbf60c58463c972739748ee.html
Resource
win10v2004-20240221-en
General
-
Target
a222927ecdbf60c58463c972739748ee.html
-
Size
53KB
-
MD5
a222927ecdbf60c58463c972739748ee
-
SHA1
8ceba51dedf9aea4224de0d3a7cddf0495fc6489
-
SHA256
e515f22d475ee77d566b64638adcbeb00dc6306f7b1e8e88d09c8af7f2789faf
-
SHA512
a0490a7e46d18e2764f3f82276af07830d24619b8d5f1288dab744867ac7f257c1b6f6e7b0df005c867f65879cd285a26208ec4dbeedf7d4f346536e077f11d8
-
SSDEEP
1536:CkgUiIakTqGivi+PyUTrunlY163Nj+q5VyvR0w2AzTICbbcoi/t9M/dNwIUTDmDM:CkgUiIakTqGivi+PyUTrunlY163Nj+ql
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000cef8b63923e819db2705a9792ecdc84ea62ba9925910f493be43f84a6f490a95000000000e80000000020000200000000f74d0e3f2ae60f8ad1bd15093196fa5e0fe5c7954353b6508f5ce1b7c78e7cc20000000b04a3d7a22138b21b10d804d9f8aaad709bb478d5dc9ac7f9f896df08c22066a4000000002edb3ce89cb8bcdaa2725d97fec67b6758aeedba89bebd5501c844530c06fff5428d82300121cd1f6770c9e1b651bbc0d27a176cab62fe325a831bc9602d132 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3CF7EDE1-D325-11EE-B0EF-E25BC60B6402} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000008ac0b33194d77e1f19f8cfa052b6aa8af9400508b07f3277643f132233440322000000000e8000000002000020000000d4842b7b9d3e40fb640f7a90464323b824a6b0735cabaa790c812b56b0ba6483900000002957abb56ed1d4421abd9462f79e2c7a4b099c991dcc66b495b247e4b8b76f30d985d481a71e74c6ad61b4c0c9681d788922672a7a6534cd601b55a501bb7784d881a06b13f3bc142d32d92fe18d2b486a1ba57ff5499a74f98dee184ecc0a2a5237306f6d8edf0ade4eab46e601b3d3cc5f624aa3fbdda4af5634d8c4182d85e28d6ccb634e8d84a52a2d2f78ae1a7c400000006ca81b3cf235f412a21fa2ce174dd8590322584dd3c06d65372b28d8c7f590d882f1e0f0506d6cf90aee151a3c747171ff8524c913f3e1e7b09cb67bae6a2bd9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5025e3133267da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414948614" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2352 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2352 iexplore.exe 2352 iexplore.exe 2364 IEXPLORE.EXE 2364 IEXPLORE.EXE 2364 IEXPLORE.EXE 2364 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2364 2352 iexplore.exe 30 PID 2352 wrote to memory of 2364 2352 iexplore.exe 30 PID 2352 wrote to memory of 2364 2352 iexplore.exe 30 PID 2352 wrote to memory of 2364 2352 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a222927ecdbf60c58463c972739748ee.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2364
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c848f6194a73a75caa0282571dad3c9f
SHA1d4322ae09f7542999241929f0221ed74d42d66d1
SHA25688482f4bfd420dc9ee1c4c45b9283265087aa0c92c151b787d7a0b00d203bec4
SHA512705ebf64b56fb1bc47829740dab17d7af267b5824bbe542b865fcd9a74e6f0057a8c858f709763978dfe1d63a8de4100805bb9b4aa69bc47c9fc3d3126829194
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2f691f73cba98ecf34b61fe6614cf43
SHA1f75211bb5cf8759034a5d3bd57c100bbdf8f3547
SHA256d795094775970726a240b9d08c796e8e1da78e4784cea7b683bcf19e2873adf0
SHA512dbf2f24c5242d80ef2ab79ca99a081502212ee70ddea2a7f724191cf48cecdb532ebce29b18a057bf5409927f85ff5df89598525487c3122dbf0074aa2ed5c9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcba65a748c4ad4c98944aa19dc2b437
SHA1c6d0dc8c1d84612fa1acd5ef20c84fc5be8cc9cf
SHA256b7301c3a56a601e057d7bb084c94083789987089709c2085c44d34a7bc7db2b1
SHA512be464bbad80cfc9ac37db33b3d2576aff459de0128a856342c010025f0a1cd248dc5579e6bbbe384ab96e1c2c88a400b74c1a505ae23f3cb55f1ff97eead93e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d064b3a20694e75f346726a6a68539e6
SHA130d9646d8a718e11d4adc19409a7f6426d01992f
SHA2560f605aa13d7cb3e21a083ac6a9b1b690ed3aab91aaaf58b07cd62f50f12f3449
SHA512c6435c9800373029428b328273e7b447e30175e7f2a3f85244912e997b3e2bff065ebe3f6663de892ec83d9a8644746f28421d27d1f0ac5d10a4758501c60db6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585e81e6b1ebf4c06e0c0746f99f24274
SHA1088d2763edcea6be0b6952b4889c8602010b4f1b
SHA25656dd31ab97316be15b76774b3f514200467ad39c0bfd5c29512e5992b29ade18
SHA512db4cde55f5e1e52186826fa77a9aece6f70887223e61856200b267b24ff98d2713023e150f8dc78ea57caaad54650b24df2e4234bf4816d79e019daa6330fb99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e953cdeacbbf0303435e35aab811cc3
SHA158b5895ccb2648724883ca936f716a6ef063672f
SHA2566afcd7fe5b59e2010ceef20a9b31ea1bc6cd0ad1a796d11ef1f7e285d6b51b61
SHA512d3497cb1a6ebcda25b9327e6c050b80728fbde0a94c787ddf70d7f501730b52e75f5cbfb7237f48e4fd54101c8e26c24b755a27fb3f89cbc3f3460752de01fbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c885cdd1fe5bcf811c86deda0ea4d022
SHA10acfddec753b3c771e28af0912c897db5627fc2c
SHA2562ee82c0fda572dd01bdbb87c7277c98785e6f450cdf9c30e6c58401da3988102
SHA512a7c693c58564ba1ba7c4824a8d4aa5a22605bc3919a34f496dafff1dc259b77a4e9471e8740487da75401f71fe32169dfc68b68883a6f4f5ea9c016d962a452f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c5ae1aa68d0fcce26d89df1c311ab43
SHA1f20e353f0da3a4a7821f2f70406d86f6092d86a0
SHA25676faada6cfb6d254344b92963f129d3968442deae07000b0eb182e347ff2c62c
SHA5129d7fc03fdafe5cbb25ffc9a61676d17a67f42e3e065f102dc67f78968b83e1ee93d5a2f1e8e866e9c2f4f2e0195068066da5da2fec5710b23c401841737fb3e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5236c876760047f77cd2993d81106fe74
SHA1d36d0c15f203e80cb73168abe10aecafb83fe9b5
SHA256fdb1349f2d98df1bbb4db9473818765f769533ae46cac8257791fdc5300295e9
SHA5127cc5b545038eb7013c77f933be5379d0d6bc000f1eba650286db4d99e7189701db867846d41517ab647bed1b19ee525339551776b406219f682ad975d31f368b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc8f72714e62a4a1ee59285e95f6fa27
SHA1d6276932d51e65efc462a95e143a76f70a3356b8
SHA2568c601d7f80e814bcb72a98f7a5b8f56ed1d6bb21ce1efbf4a864227b671cde20
SHA512dab74b76e5ab523215418e4a5b5072e9721e3b19831ebe41e0e85115d6313fcd9478d10064a1372d20dd31609fbcefe5d62e268a474eaa4d485e98bb33a96e18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3d3372abc474947c4999c732afc091e
SHA19f8d740659992573bd4e901ea2269774eed8cf7e
SHA256d922ee9e5c2e634718b52ea4fe65dd32aeb8c53d9c0f17fbcc2b1540c48e52e9
SHA512c97e89d46d769e13abf2441236ba9efc83faacf1cc3481059def80cd0c80016ccaa6a98278ea014760ba4013c2688d046c99dfa3529d5ed3220ebc0740965207
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4ac2b9ec45703231f6646d6dc7808e9
SHA1d4b655d9fef73e22a6d2a7fd81409d29c82342ca
SHA2567e5f6832da5fed6a1812cd1be8df079017ac8cec9766a56cbf5acabe684260b1
SHA512073ad802fd43cae74922ba20dfeb5ab6a3fb5d5c21103bfaadf6875b6b4cc58a71a988df24cb79e72c16544bbe4363c91affadeb13f2a9275a2c45fa3b407116
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59757215acbc8a35f6fabee19738f35eb
SHA1ab47bf275f6439b2e0ac5a761e9e84aaa793df76
SHA256685ddef18da7035f7cff0f21b1c848c8f893429bcc80a41ee72b954493ffc61f
SHA51234dfe710857000623f2f48cbfb47cc64ead983cf394ac5971511dbc5fad7acdfd8bdd74c2e818e5d699b3875da62833c1ba8269b7037402c279a10b8d6e5de2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5871a1b3374b7646930f810294e18a6cc
SHA1fca2ca0ac35ca4cf7ea2e3955fc57d43b7023f52
SHA25621296f5e4820e3664e6be48d1b34c96969c7ee609ae1e880420c1e42f2c39e36
SHA51273e4f63e8211aec5ab699b878d9a283f80ba4ca9142d01d3b338ef70e6e2686a97aafb3eabf3fbe49dad8be15ede6b6afc2d3c61c74d6c4d3975ba4b8a148cef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4dd566022b72dc38d35750c11114e7e
SHA11fca39a90eae64a92e8946aefa28b15afaf624c1
SHA256df8f301a8d9176a1fb151fb2a7c008f301eb66a9cdf7e632058372002a6fb96a
SHA51251c239ea6afed371e46e5ac1bdefefe3dfa4946fe75733a0faf51a6c89993804ebcc58d76ad24654c2d12b563b209a9794e723f8e8ccff74c8876abda22667f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b7f475a67e598a12d10fc8539677b2d
SHA1079b71af64f3a3a4d3fed28a408c50d292da7285
SHA256393ae59e6d69cfc2441fccaf1dffece1befce2e528c22c909d7cd17ae337cb02
SHA51267475781dd0b64bf456f616eb88f1ea43eb0cb6512fb0604262ea8317639aad1feef0edddaeb699b673325550b7c01598ea40199661c14e87684c456986b773d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7b9f5d855e794c2a1350cc9c25e8991
SHA16b53669ab907fb4d44a0e73d5af761dc3bf28dea
SHA256a27e423b8aa3fc8702791bc24e9876a50cbb48851d5b638268033efde2a66d3d
SHA512405e84bc06893df1ee379a4dc35e2ee572270e7239f437768d0c71102efe98355e5836a4e1635a05f6a0cf9faef3d5953eaee9f08485c3f936592ad7eb6244cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b40b919a481ffe936ea152bbbcb0298
SHA13d9c711f42fffe16e8773d071bffd48a202fba12
SHA256c560855cf415424389b0eb4ce7d30541b2e553142b98828f002452377c35135a
SHA512bb38811641313142a137da7dd6907e00cc87ec6d2a892c2f3aac8e4f291621c4521fbc09d13a052327d570fbddedff8f0a64711b350127eed40bd55e6f191fdf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXAFS242\style[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06