Analysis
-
max time kernel
118s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 15:03
Static task
static1
Behavioral task
behavioral1
Sample
a2249bc43cf62d16c4192bc21e0c7df5.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
a2249bc43cf62d16c4192bc21e0c7df5.html
Resource
win10v2004-20240221-en
General
-
Target
a2249bc43cf62d16c4192bc21e0c7df5.html
-
Size
28KB
-
MD5
a2249bc43cf62d16c4192bc21e0c7df5
-
SHA1
61515fba9dbe03b511806b20eb161592ac2495fe
-
SHA256
9407c0e92a79cc655655bedbbe2dd22acb3b95f723d125175f1f51da5011c5f7
-
SHA512
3b56fcdcd32fed3a0092c4369733ea9f828563783cb77a5c74a882d7327678641ea1d3980ead4e64d947277b0969fce1096e0b565cda7e07234639d315e64b6d
-
SSDEEP
192:uw3sb5nR2PYnQjxn5Q/FnQieYNn0nQOkEntn3nQTbnBnQ9ei0m6Apym7rQl7MB4l:dQ/IHMQymGSi
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000001d9252fc215600f748964e5fd693cf214685a315923a84efc3270fa3305feeff000000000e80000000020000200000002e8b9fe1fb19e5d2d371508450e7424c13be03bee499d90d0b22db4bbc8bbce8900000000132b288afa4577db5aae007b196abf3301af3cb98a947b1a1c0e0d708dc8469d8dc34552c24e9d307a512b13fc213db29c2bcd5689512b5f4729bf34dbeec47cda5f5cd87e8a4e6a4d02723bb12e476096c17a549916e4805f649afb5e4a67097c4d6aa35dea4cc443d68ac22629c6ff13ddb0f386362000720689296a8573d594b814a335b17186093658504a56bfd40000000cca3ca397b5519f1d247661776aba00e8110a1f9049cea2fd886f6d9b9b0806fb8af8edf5d956b7f41eeb3886227859f248c002c110475e1e86ef781f95a5e11 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0A929F1-D325-11EE-A596-F62ADD16694A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414948858" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000ba8a8fae082bb82deff40d3ca62f059ffd38bf32668158a84de026850419178c000000000e800000000200002000000054ce629b885da496b169665a7c1e47a49b19f5b5db8e9c74041bea176134757d2000000020cc5196b77576fe04f699da9bcf7b2e8b8e1ce3930db9c506497c089f52b641400000007f3f4a062957baca2d53bfe29d5cfe2d5d02fd6446231463c9e8a003c43190fc3cd6542e04af66f81c99136908db49137135becf1e96f891501fb5f20a71f3ba iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01e5da53267da01 iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2564 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2356 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2356 iexplore.exe 2356 iexplore.exe 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE 2564 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2564 2356 iexplore.exe 28 PID 2356 wrote to memory of 2564 2356 iexplore.exe 28 PID 2356 wrote to memory of 2564 2356 iexplore.exe 28 PID 2356 wrote to memory of 2564 2356 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2249bc43cf62d16c4192bc21e0c7df5.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2564
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5622f548a5c212d405ae3463c305941f4
SHA167289501c17788bc118fe36520266c7ca455199a
SHA2561e7385e53e6e7d31477c3e275e6b5deb89f47e0ad27e142b137ad242e53f227d
SHA512ab32c2a9d87a17cc7515910dcd62d5aabb8f9796f26f406b0c5ebbb6428a7305246d07ee9148fc54ed2b93921401a52770e8428f3ddd2e8ec53e0793271d6ba7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55db3c9bfafa3378979cd2cd9544e1135
SHA10a68ade4211b065889983a57824df20c586de3a0
SHA2565142ffec0f105fa67a6b12b18372da785cc47a116ca3b2c0a539470055eb6f3f
SHA512afa91b0f3a8e7044b6e6483948624b0498a5904a0f081f95e507a747bd829e6c5a54f18b8d815653ace620cba0776343425f85b327ea35f995365782710e9895
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ec4e3bf1ec8842afa33098391aff049
SHA10438f391d546b8e1dd4193ef597ed34c0240534c
SHA2568dc072fa432d3381ee8c1934c6d5cf76cea6c425f401e2b4a94730fc8b554d6a
SHA5125dfb667f8189ff9240d6b59d085073a086a41c3b7b5b545300a16c5e36455c3d42a0af9ac113baac02a494f937606cae9a274da59087219ab5c423b9a6c97d31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3521bc31afc73e76904b6ef39920b76
SHA11cc8b0978133d066e79c2b6337eb28c53ead08b8
SHA2566a6670f80f78af2bef17ab028c3140a51ed77abd57d72a342f92b851ad1df755
SHA512ae8c28a55ca91ac90ee1d3685b11e8b1b58294f6544e6ee7b10d7afe24802305dcf0e6bc6abb136d26d5ede1f03dc65d03311a82c8bf3d24cc0468d20f0224cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d5684c80f9fb3a4e1a160fe0785feb8
SHA1aa4518892a6927259fbe0639c3a91010a3a81f46
SHA2569113a82a9af0b013f7e0dae09e60d02dd9bb432c88cb695db398e3c80b062f34
SHA512e214de84df095a919d744a325a588aa62f4926d30717cd4c42f0f2e1d15fc416aac6f17149236a1c354da575a7b6e4ae9ea8ecf7a532ed85bd83356452fc3c73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5071dd4988bba0e763de42dbbfa0eb2ed
SHA1ef77bee8605da01f7426655b6da15026a9c08e05
SHA2568eda6bf42f3f73b74e8ab72036c018931d20f9d600eb1802f0fce70720070e06
SHA5124f279736406980787ac9e20f090c9e0fe94b31921229818cd25a6353a4263bfd8a045a6c5bd53c3af6cd73d10f59018a0cb6221ba1b6dceb80a4983b254d1d36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b159cc7f6c6716703dadc38f669dc80b
SHA10f343799a9d020cf2d172c7dac10b6929ab83dcb
SHA256df63743d52bab84b60e62555e7ca30f4d8092a2233795025945943c3e615e725
SHA5120c947366942c212ed523494843c250a3a2422f94d8eda2f7f9b623ca7b6359e4b6ff9f6c1003bf0ba29e1fe091282ed87169597c8604c578b7b22ebcb304dfa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56489fa128c1a5b160874ef4a6322f113
SHA1d61e9185ec40ed1db1ab547976ce3fe9f7d13e98
SHA256fd097fbd5e234218d725286da9a61400c5923d2e9c966d0a62ad7bd22ddbe46d
SHA512b4aa72c4813e6f2ee17a1d3936cc65d06cdbdd524542fec140c3500a9d79a59c45434fb5f6584e7c05d0f4755d955c2f2608c1f0a15397946c395a5fb0bfda9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd681f732738c24f75660bd3abd4b159
SHA168d3e887289200088a5403eb7d1a6218a3657307
SHA256c217da213eca632f541cb67511fdcc30408903456a8266b51c11d470b8820323
SHA512a377bf451d96cc6b1834dc3785f6707bb4c7df302d0c5587e8ded7394d3cf9de962d8cea1bed03b624c592b81b93ed479eb572e8f8ab4b57e0af8a689b799cc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe7e7cf6ea026ca125d804cbbdac8a0d
SHA1615ff310b097345eb2c5bc92b1ad35ec50abe933
SHA25670c26e9e2ec20013b1d8b8ee267618bde9e81878a2f5d31025fa277413fdeb76
SHA5120e29c6ded0482d68f1dd6719c31fc00d9b42ba5c1219a2f93dd08106afac2f5020dde6893fe9d0c0bff4d706952cb14b49f5e16747a3a9862d094bfff52bbd3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50005dd1b7595448b00321723cd9c9efc
SHA127b3ddbc1898af3037673632a41cf22d4d40d250
SHA2569f78a06f1cf9f43ff3f476ab71cdb06a204ef9f7f786a51a4275ac0ff5d14533
SHA5120c1b45e00b17dd95e9514b2ba4dc9c3f7084548649e4c00f0baa03ce9c289252a18d2ddd9e7f8760836c20d65a16d21895dcedd09a858f4d8a5d0f92510ed477
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a310a79c6710962a25ae488660fe52db
SHA1aac4d3ec28f0acb54446c84fa08fac0d8a60ad59
SHA2567adf70f76344d40a0d7542a46c25bd200c994d7dbfce9069bac968bcb0105363
SHA512b90d5c9c8d64f0ad1ec35e627c4b4abae3b3d4ccd3375ba4f2e75e4df5fb9a9a9f49a10871458e2da6fbe25cb8e1c05c29b7cdf9ca0a2f6cd6f306eeb6d1bc7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2a4fd3b4e2f897d809e99da4640476f
SHA170f8b4745c7089984e7daf8ad7c6e232b59b4c58
SHA2564a91eb00b972312ac975234846f3a3c6dc0ccbb115f74e21270f252fca1499c3
SHA512d607eaf0496742b98b56bb45b5b91baffb51aaa7e61605a79819a7ce8a351dce27758e31ba75fdc8042e0f2f0c1a7e42c0f7bd582a7b1e3481624d15ba851930
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52be1e121cbdcda2fa9ce6cae6a99e947
SHA1f51f9bf9c2376bbc89c36eff137b25f0a8d5063e
SHA256fe10f21d1bcb1cd9fe2b17f125b73022f09e61b0f1599c560c9b56d988cfcae3
SHA5124946d110925cc94c45b9588c0f2a10d29daa7dd8fcaf01b25708bf9d26b6ad4d9a264b1796eb9762732a477f5cc7f8a2c9aad9b275b4e601e57c5100ab26fba1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5bef780d6ac8c8e1157762fa4c5770f
SHA130452452815f134fd8efd9626ba45fffc642af9e
SHA25651d1600e6c6b388ac4f2979878825f71858372c6e9c47df103b764caec3d6cb1
SHA512f25dfde73f955cf98da995b9f982f0c236290993a7f8c9332ca1f4a0391032062ee317a50985f51ee6c903234df124ec764451c5cf1acd9c5616b50ecef64d36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58341431de4236f1265f619cc73b08a97
SHA16e8ae124715374e12d498c482602c5114fa1da6c
SHA25673ef81d6afb51c06fb551733149fc14cc051fb84d893190d2e88addb53a6fe3c
SHA512624d44add63e7467826773ccae7df41f28576673e42742ce44dce84bd5f2e90e163944657f918c21e058cec831bb44f734ffa1bcbb99fd1043de8322a3342790
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06