Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25/02/2024, 06:02
Static task
static1
Behavioral task
behavioral1
Sample
a3101fdac7c35d010178a606f12810a1.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a3101fdac7c35d010178a606f12810a1.html
Resource
win10v2004-20240221-en
General
-
Target
a3101fdac7c35d010178a606f12810a1.html
-
Size
45KB
-
MD5
a3101fdac7c35d010178a606f12810a1
-
SHA1
ebf2cb520ec8615fc2b85ae38f493507f37cf475
-
SHA256
7740d363bf4526c1da6fffc8d5d900d5b39b753a9789882fa0f1f6c88193aab3
-
SHA512
f44058631c0e4f197828dba153245e3211dc9251f19ce8729d190edd6152580c82ede61574259040ffa957cd63d37ea756f695c2e976de8bcd0370f37a5d229f
-
SSDEEP
768:zIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZXvE:zIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60521459b067da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000f48e41f178398b1534c256aaf0976614340798f605c615880acee9ff2e34c9fe000000000e8000000002000020000000af0b1216ac76539d1962f4351230b64e0c563f26e2650ec15ecaf47dd39728849000000090b6ee3cc1769f0e140fab48347261281d7dc16da47b9320ee9ac7ed5590bfbeb39623c15882510c2b78fee9e1e7129e390ed568ef4a113475c0aed01056d87646ff59f003f249295b01b65b2ee96980e7e6ea2e1854c447f8765222ccb20e1c463c2958b7fb4efd7018faca91bf91f3633f642d8e6e876559783cab366703af771136b85aa0d4a5bd9a7b076dc0c0664000000009949c953c0741dae615519181eb1c0c94d9883373d779dcf215f88a4ff534a48764717cca49928622cb36386fbfef8965a548c69770ae08b7238e660f884b95 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8401DA61-D3A3-11EE-9A4D-7A846B3196C4} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415002842" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000a904ad978f9b7b395ca49ad701efe170088b92501b5fa70d69dce37358184bdc000000000e80000000020000200000002dbc1adb6f0799355ab00e29d0176ac6a888456d89243350ac307545591ba811200000003697f5ea337254d0c8d3150d859e79e67f35949ee9d20afeaf5285a487713d7f400000003974792abde8539fb780fa24bab67665563df162076d6f621241962b3265c95d5b3e4de6d18474515a4df8670529e7fcb3f63637f1ba8698c7c923d01f4e76f5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2916 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2916 iexplore.exe 2916 iexplore.exe 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2444 2916 iexplore.exe 28 PID 2916 wrote to memory of 2444 2916 iexplore.exe 28 PID 2916 wrote to memory of 2444 2916 iexplore.exe 28 PID 2916 wrote to memory of 2444 2916 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3101fdac7c35d010178a606f12810a1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e9a254bf5471ce7b67e72d2ff561b03
SHA1b5377425731f0b723a8e0f7b1112896348317269
SHA256338e639235684e62314d0c43fff5859c7f69dda700b603e07118f11719c18c73
SHA5121c446ea58dfa4500b78b828ba522d1d2603b71b60aabc1f0197da1f1510b8ebb9176b09218246e4a7e1f5535cb13438d4f3701155d27362f74bfda865059e44d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50aa531216d96b1b70b3c6a00ef9542f2
SHA1e9f707de566591b6417911d2497a4c8fc9f4a66b
SHA256297ef7a5802374c1581a8db9af962b8494158e0daf5c48542f11aa9bad701ef9
SHA512ccb953d750c5050627e7c9a7631c8e66153188b7e7d0c449a09c324e017657e43d76825212f3d64d61a823f13119f677538a34f7a4cbc9216dd77aa9e24ff8a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516951b54d98f50481a3d696aa3dee02f
SHA1c11725f6c1f417e43982ef27c527e5c840cb50ba
SHA256f7df0bd206970c36bfa700738e0d110e83c481904c9c2f0a396f39230d5ac849
SHA5128b68e59c04cfd438a4f66865d56a5cea02bd8da5c98e2bb67adc46ceceea77eabe03f05a5ba99c2783bf43d26ccbb0221ce2ba8f14c94cc3052ce923b2f783bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0dd7f97ebaaaf880ff05dd1a28a9d50
SHA1260a3087fbf23ba19595dea08cd90ec044127ff8
SHA256c67a68601bc878a0799be9f7508be39ca02960daea10eb17a65532814d04e26b
SHA512d62da73aee353e64b64f07b0d64d8d2c6e11f52241c140fdfaf5485670a0980e2a8872424d8dfbc44d4bb7f578eed9f41377a158c5a985c55062b33532d2606a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518528a28edb2e2d465bdf654540aabe4
SHA1914520db899a614ebc681c1d2013a378f30db5ad
SHA2565f2bd5b19b20e419923b58383988a8250125f64ca8da9bcad5bea2ad59c8d4a9
SHA51263ce20feb9be1ff6b9e118ed8c35dbdf05797dda67cb5b07ca8b4e34e160139807d6ea150b9d8230d864bd4af174aba54f1d3c7a7081ccabaaabc25a4a17e1e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598603e621255fe2df1b13fd5bfbe403c
SHA1bd51c1cff1ecc6515859598113423af2865b5b11
SHA256181544a9d7752e11f3c4e8180760f7452018a583d5cfafbd1cf6e93eb88281da
SHA51244c59768a372c1ec34c704497c01dd617a9dae3d76b550648788bd901627c23dd41953a32138ac58478c156bf525a96849474a086bcd26194d39c3a6c7c493f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0b97a15086168e37508833b9e3cd0e7
SHA1f5943526015d0d0244cc8f1e65496d8ec4210edf
SHA25625cbb8fe64f12cdd1ea65001db1fdf35e005b1dbdeaae9d767050ddc64453970
SHA512a2fd49ce73729a72fa3b3b5586e60d0b295a1fdd3d87a30655f4c190742fc6b7d7eb747249543cf5b4b237d8a7620d4a029c02616b88edd19f2224c26e666a91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da5ea16c7168084ba140597ff8025e06
SHA1958274321901126b5b7f8c4871daa244391c141f
SHA256b7ef014394708b379ba49f2097d63e5cba3a84e340f9393b84800d3316ec5e76
SHA5120e164eb251e9016112f41ff354ca27fc5694601d3bcae74182c4addb2f82a372bf6aaa4260723144fe42cc55b384148022438d81a370397ec3bce5befa926d5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cec7541522ebfc8f1d5f1c91525e92ef
SHA1134259ae58efccc7ff67b85ca6feef189077eed8
SHA256c57d60fcba3b55bc01e83a9d46ea86a796c0cf2231e772a6c8368cbfc0e93413
SHA512eb26a69d33cc1fd3380fd4d57c0570d803da926bdce085d6feb926938ec2f26094d9d067c678b6e3f643ce52670d0263db85295448c316fc10927f1ebe3854a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543409e438f5ba386d07669081f96efb3
SHA18b67a8b4d374b20c9d6eebd28711f32e7372e7b8
SHA2564687170d51833bdca274f36c4a5d16b5bf1ae1afa3237a4b8f0f1b6c6ae3d1f1
SHA512d7817623fd88458f1315a862f3e6e0edca045fdbc19c92bf5b0604e4430ace4c6139813ce5ce19653aa5e079be7eb55f5f53cce3be976397a2bbd7ff0f34309a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af29644d818450f9694701215e1970c1
SHA1370c8fb8c513a9f91b663187521f45a358485b1d
SHA2562541bd10f84f1116a230205925b675ef88fefc7e87ac857655ef56712e6c0cc1
SHA512301593e54b5eb6c60e3d6f3f7174ae387ce9e927938220e84fcb5231ade1887e721ba769b7d5f3b1a1336a6c0465e87a60f6181732e7280980579104a2e4494e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdd99aed940de43ae76c278ef89706e0
SHA1db69c92bcc07828d50f098c81a7d432f8303248c
SHA2569e64891535de9f19b2a2ea441d9a754ca7a60ef1b268152415df393bff811048
SHA51280e419358e5fac134b96f0d1b80e8428623c530567da549840ed07a34f963a1774184a204e117d9557e1a629fb39f83c0a78dacec28eaeabd431cb9222dff9d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8d2de9dd9e1be11e7f4f6485cc3e972
SHA14b109b0c5d9cc8e814a12a8bff4e1ba300813449
SHA256f0730c5e8de17e11cc1d4de294b7cfa4167bae520878f8bddbf053f8ddfc0b97
SHA5123a63cdabda2f289723b5cd85e2f685d4387107822985efc8db6d29b904c5a70302826ac4ad52ea4b6bd0f00c4f88c90ede77b2a9239f654a6b8e1f495cb60054
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568a44870962f0538e2f7af11cddc0cda
SHA183f7ae404813310f4d434fad705ed4a1d5dcbb22
SHA2563d406c46fc932ff68af0c1437785716011201eea6fb7e7d377a3b5a243f45845
SHA51286a1c2ee6c96cf74ec7cbd7c290a1b58a4dc54ace9a8c94a56333614506fbe404721d43a8794f0ce4510be9cd0e5db53bffab5fc02d3ea5ee4a346f8da2ba65f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9627c6c35439f0d192f1a0b89b38fa9
SHA11158f340534759ff975035f455eddce869fd44e9
SHA256a204aaa1a1ad9859afc85b0d17ac9ebf07084c573e9692a6c10f9b6562f747d8
SHA512f3482a0461f05d2115a87a264317c539aeb7f5538f19ea80558f7473e03c411d05c47a3fe3d4a97e789a962942bd9f9f3efc0982895df7a1fd8ebb731df98cd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c95eb4a62363644862e04df04df7d63
SHA15047b39bda5c6e9e40ca74f9ecef7fb2aa90ab16
SHA25611660e6724ed4f6ed694c4a4dd266ef6b1ad0d965d7a9f563d20d0c6008a64c8
SHA5123d0e9fca053a40e5a2d8537c67c0b97db7d975a506339f363e0c2b9d2e7bebb24c7367b949a1c73e10c07370b7e41f8370c7ce97c2a97a642db82ccffa246931
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5061bb4a7f59e10a06081bd882d954694
SHA18cbf10b89728ca223f09afa4067a0c1667a823d0
SHA2568c0336e813da34e35ee7758946c2153cf7763443612aae11b9dd6ab661e84d8b
SHA512a2b187c7208ee17fb513811efd08f422f0793955382fba59d9b990bb512b9a96d5f00e09f3605197aab439259c29d069c15f29c335e3aaf1517c49bb8078153b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503c3765b3e3c047aa8a9c536eb1c90d2
SHA1b4d9d397fbb610fa70f2cfc3d816d41d0886c6c6
SHA2568650ba1440305fc6218b2d6f6a72a94809f2f5cbbd05a725c2918f7ee0ecd278
SHA512806d06392e567149db22841431090423b5cb95b8546c30d4aef147e847cb49e00c54ca4ff4b7b2e595c09fd4421b0b909a23c098c96f0253da53478c59577b1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a791de4c17d7ec5ff71be8fb420f76c
SHA15403e8906062136fd39ca76a5c6ed6acc7940673
SHA256fd205bbc113540eff102b547599c6b9cbb36e7b08a1dd8ead3940420c255734b
SHA5120419b83511b2c113de886fa9e4ad2a24c0b7e638706e05afc9553bb46832d98fcc7ba7e00e3355b0467e46334551b105c99c409ee32d24193eb3beb4376ef248
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06