Analysis
-
max time kernel
121s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-02-2024 09:31
Static task
static1
Behavioral task
behavioral1
Sample
a370f66af41662c6d90cc9c18a8c3aa2.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a370f66af41662c6d90cc9c18a8c3aa2.html
Resource
win10v2004-20240221-en
General
-
Target
a370f66af41662c6d90cc9c18a8c3aa2.html
-
Size
2KB
-
MD5
a370f66af41662c6d90cc9c18a8c3aa2
-
SHA1
e79fca8f748ec9cc490010f63870c65bcd122b23
-
SHA256
1edfa1ce44c4d69e19999c59e8f0c26e594999dd5bf73bafc0c2f9bdec38f403
-
SHA512
4ffea46221bd83ed8cc84bfe7bf5aa2572f6397996ab80ce55b5ef2b5654f5dc4b30020bf27046fd2fc282aef5f54affb3e62f56ed2e0b93a404cdd319eb17e7
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415015344" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000005888c91dc5d7e689baac35681c97282e6e7a7b80e53f1dd7fa5d5206c6599ea5000000000e8000000002000020000000d723910515d42673de2a57cd4ee050720f9fe600f389b0b30b72f2b13f927e34900000003450e81744fd28f5033e5bbfd8fcad4973503439080fd1104ff6d699ec306fbad583e6d26007d5fbdc1b219c88b84ff43380bfb5e46833509df1d69856d1565f4f047f0d8955939a44c9ad8e16f660a76b6fa00157292737c0d3c6562890dc51f58bfe7f7b219b7ddec2cb615229436b3f31adf869ccf923154feaccb29dc85060e90fba45e1615663b23d3453a2592e40000000b04cfe97ec9cce3091666bc3039885352e8a10f7c86055cec0a674c24befce1412efe85ca5e9726fd8a36db90ea8e96b0b83c795f062313b930a0c0c36098cb5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000398e3299a5a65cb235fd0654f1b6ecd9f2de7b321deabf5007f45ae087f2da0c000000000e800000000200002000000016adcbcad6cdcfa37da9009d0437cc1dd711a132f7cb9c2330823ddfa06405ce20000000fbe04e5d235a37ed61392eaf9c45551cbc32090b444773db88fe4d46115611524000000075a04d087f6655fd6d228c3e4db52f6b3986538446984bcdcc79278b6a27710cd7b629058a34455f93a9749ecf7e82ddc8b1f3e56ab1a82539c435077fe23a51 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0cfac74cd67da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F0F9461-D3C0-11EE-AC06-EEF45767FDFF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1908 iexplore.exe 1908 iexplore.exe 1396 IEXPLORE.EXE 1396 IEXPLORE.EXE 1396 IEXPLORE.EXE 1396 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1908 wrote to memory of 1396 1908 iexplore.exe 1 PID 1908 wrote to memory of 1396 1908 iexplore.exe 1 PID 1908 wrote to memory of 1396 1908 iexplore.exe 1 PID 1908 wrote to memory of 1396 1908 iexplore.exe 1
Processes
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:21⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1396
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a370f66af41662c6d90cc9c18a8c3aa2.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54bdc919c4e4ea5a5e29d203eec626ee1
SHA18a83bca42564879da30a83e93ad40252e5b01652
SHA256d51d963864b65d2f49af35682c3b606b1ef2034c573b965452ee34de2178b72b
SHA512a605f0c1450814039b653522fb8de4478d289080abc213f7263b248e757f55589dea780bccdd7ee161f84567723730e33a5512f6aa9c3157026c0ee2347bf012
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e684f54c97820c4c5c26efb32d4f086c
SHA13e7bb2237b01547f382b9a1c43334eae951e2952
SHA2564498d49dccce4ed425e73f5c2d79cfddabd695e9d3c04253c02c74633a04025e
SHA512cb588ed31cbcd2ab7b8f8ee5fcb347e4cc6356e183285a8dbf3995cca1857ef00a6b946a8b1b3fdfb6df9fc6b08c6c9051c4b9a034145da9c269e9155284618b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abfffdec13bf02e34ccbc1a4da0d557c
SHA1e4605e2d925286970d409dfb075f72a6e9ab41d6
SHA256936e8618a05b5d0e1f00c25ae730b9715323e9e26f3290cb07b6ffdc18d95eeb
SHA512ad188a719b489619fe027f71d504c57ccbc645befef13629cfc91334fa2509680c0dfa3842870efa106a8005f2869b4e3ab26ca4d3bc70a752d1a2f6fe5fc8d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eefe9b078c4491286a814a07ca1a93fe
SHA1e5b12a05d73886662858c901aba8e09c9a45da2e
SHA256c6fbceb172d8f0a49af0bc37876d029cf7c54898940a69dfa15d9e38ea1ad4b3
SHA5125226473953c37954232038728cd8f11b615ccb41f38a4ac7c8773010a5deeaa45bce3b5659a9a0270ec041c4b1f42ae4cc0050b608294a33f88037485a2825e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b741f84c9b3ee4d7aac4897e9226fc8
SHA1ee5be7b2e2f2ea073be41179494ff7ad88e95038
SHA25694cee769637465002c0f6d3a624008668240ac39ea5c2917326e0a60fcc861cf
SHA512ff6f444a313d7b0e1bb8d852086a6395d7b0bdc3280325cb057474acd924dd222e40769e3d094c2eab1369fae51af434c537366598f0eda15721567139c5e586
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568a40165847a4f11b9879eb277eb8ba8
SHA11199b9aa3fda27153e4b7696ebb5091dbd45f1fe
SHA256ab5d09f3622c11129826eb68579db8029bf174f92de514fc2cb693548d538bd2
SHA512d484ae893abb5dbfc73d11e6a516dd8f22cf4b52b76ede642453ef7d84ea4e233d0a5f30e12bbb867c0fb3b407afd7ebd186f5db7d7775468dfa7e106659f7a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5beebb1d70e33dc31dc6a9bb3c4d86903
SHA122e52d128dbe93c0d611cacc2f34dc2f39761c2a
SHA256b0dfa965bd64ae57a4d6f54779945a9fb069038dccffbc51ba419db36827f2b5
SHA512673895183041c756f4bcd299f59b0158570120296d36de17b582afab1602c4e3b99ad719c89c1cd1bf359a9995c42980619f47885a2da242de226985ef788305
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e077e7a14170c75ebc7989f9b4b98593
SHA1cad8585fefd1de1f23ebba424f8ba5e82c4df707
SHA25690a6fcb80e86e1a1238d3667d709b03f0ac527edb3b6a80b9e7cd0c61836e348
SHA5122707e4fcabcd5e898be60535c5012f7dcdd65e37c5287084e22ba63ca9c34aa2c0c7fed7fd008dcfcce08fab68c27d4211b50ac8bf92fee7f135c88960adf3fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5901c5c9d42481e57d24fbad66be2d7c2
SHA17ff03ecad59e51b29b4f5dbe52e23c6c1a68372d
SHA256b4c0fcbe6c63f05168486ac2d5f3fdda89df3bbbda6e7e0278e6b2da14d91f60
SHA512985ca94d87e17c4564352f99a1e920a443fbc77d76c54990bccbe0b5a169ff21ee2926bdc090a106e21b792387589033d611f26588d26ca7d69c66bb0aad706f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bb24792410d44cc5a036921aece4b1f
SHA1a8bb75b64c8329b8a3e638098c436b818605d751
SHA256034a532a1aea188265c2a07db94891e2eeef8b3e1b70fe3397699c5be3a8ae60
SHA5125594274ae98d28da7dd9cc64f050d87fe8798a0a28a651481db389b56c58429c39e76ee596f53fde843542b57a472950dbf9494e86aff0b4ec278a59cf6fe07e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abe00a5a92779bdc0a2aeaf6da954dff
SHA1c7b05525d27153251cbe0e6b5e96a082d7edb964
SHA2568ff6d428521532afce292907fb0f929ff83d6bb626cdec70dfe84c9a3ad9e542
SHA5129e38bc627baae239e113e04af60d7992d1eb08dc50226fcb6306a1d144846041b1da9f197719eb58938b0a9ed3f9eb32d313e39fe91911bf187ca16eb2772839
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2c63f5645ffcab6ba5c1a50ecae080c
SHA14d61d949d6f776ef24dd5ccc5f7174b6e2e50a01
SHA2564ee0318511d4745ed821b9db271539c0eba0bf3f66c61e080667cc9834797552
SHA512063f5ca31cef7b325780175491e42734eb0fff9903ee26738ad89b24abbe7b48e7675f1dbe5c3ec178c88d7c0cd5bf60c2b3e159d492ebb70c703dbd03fe83ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d34ca362e883a333b09e58646df51061
SHA13fb47989a4c63d6250d76ffb48d8b40981a3c957
SHA2563e7952a7cdab95a4f9ca1857beb02f4f8be19973e62f25cc4e84688ac452e7b1
SHA5124e89ea97ba468a9b356e469155443904a05534aa170d1d36ea93c7fe3726b5e4213c4f604fbf47f9db8ffcd83d24a71822d28d0d7629cca060612b4dd7ae10b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1d1ae5c6311479da7bf60adec99fe08
SHA1480443680179d644cc47c18ffbeb07dde5632085
SHA2562d37c7737eb30e65344ddc99839a6d48743b512f3dbb7cbc67c0072bf8bb9645
SHA512f555a18a0ed20f3ee0c65d0befd605b8cf4f4a49c7dccfb23f7779309d23b0d1f635fc6c29f6f27e4bf6653fd818003790bfe7cec737a50470f8ffc2b9641864
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552d4ed65c7b47e29a625d61a716401d6
SHA150455fd01012c1f22eaabff66e15c29f6553aea1
SHA256e85819ed92b42b6c8d58140a45572d4884250dfaae4c2b47dcaba88aa519072c
SHA51229ec99af74464176fe494e928246f657ac9eff9b9153fcc1379dba048d5010e1932cb46de137d5276b214141a9fbab7104a0b96a21a4765c26162c855818a171
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee95962b619a53a016aefa72b8e2c96e
SHA1376bbe6f5405a60e54245e08948aa5ce39653309
SHA25665369184e174b146a493a03dcd7b574e657fdc5bdbd8ef7f86216b379e325c56
SHA512cc40fc7da2a388fe95402cacd2d5d7c57e2d8a94b2148a164f16122e6c108298430e618bbed70ccdbbd941967dc14dfba94afd32441edb697ed698c27ede9192
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5885257a8d04b1ae814e2b18da9023fe6
SHA18c3d6067539c85b931f41229b64b9801e8044b09
SHA2562755b7646b36f4cb41fadd9eaab86693f15f144ea1a9aee77579011fc9ab671e
SHA5125e6982b5c6fa4a4afb05a47439eac1098754ca8d5b0714ed19dff1e2c0acbf405a35624b22a8b1c0d9fef9ddde5888ca9d8fa64b1e0c1fc9e254a1de19f9c824
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507be476dbf06534ef0d1d491703c4cac
SHA1e744da106388d2d237131056a2f99a86edebfa7f
SHA256da398e1cbae4d62b206059d13238417aeb2f232efc29916e0ffcbd213c3bc3dc
SHA512d3c38fae52b58ff3d8c9d6264dcfe0200350a01061f5afd3b04c4fbaebf5b6c163d2ddc5ce4c7899e8e1bfabe8603f041c2dd2339a494727cd4ea04f4533476e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54312f725f95f0dceeffb78a064a01c90
SHA11572cc7bb069a0261d52ac988adc3e2636c3ff75
SHA25601d79c2d6be3a705fe7efb66607c0b9f88f495a92d0e181986c55ef5d148536a
SHA5128e1fd48bf1e3f12fb012baa07c69d00e7a88c55c2f83cd030bf4f27597a4be866a273f43523dfc4300497f8ab0264868f906de44dfc89047a28fe1b961eb85a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e544d676fd420dcf4466bb0fccf18b44
SHA1380ac97c6a3f38ca418dd1a6d4306c8d37e3ec96
SHA256fd311a6ffdf613f4c1114e90903b5145503a1555107ab7ad990b202aa28a1f7a
SHA512502279d51364636e8b75daae65e2f5601762be287fec8cc41d51344804676c3fd8ed10f8de633551ae09ec64241ef5b4f6aa40e634ef45476b0a8203858e14d0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06