Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/02/2024, 11:01
Static task
static1
Behavioral task
behavioral1
Sample
a39d0702677fcb98a3f40ed2910d789c.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a39d0702677fcb98a3f40ed2910d789c.html
Resource
win10v2004-20240221-en
General
-
Target
a39d0702677fcb98a3f40ed2910d789c.html
-
Size
2KB
-
MD5
a39d0702677fcb98a3f40ed2910d789c
-
SHA1
1b3d0eeb71484a5df63aa0cc4474636d2972ac82
-
SHA256
12a1718739e3bf679ccb526fd3bb64628263e868a70213933061f228b2277c19
-
SHA512
24a2e205fc5987bd358337030763d021afd60ac041a0ed12e18c78a4d6c718e4e8244c1afd2d378767fb3d0d53d140eb10aa49cf63a83cf5705d5eaa4daa2923
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B658751-D3CD-11EE-B2C4-6A55B5C6A64E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000087aff75089dadd042024fbdd7120eb71dc01ba7e11d4efbe02ff9bf3b10edfea000000000e8000000002000020000000bce747142c42d9094c150ad4456be2f7a74d4a4e2ac74ae904392bc701d9352c20000000e24c8d727d6ce3c2ca9f1db7babd8f56afdaf21f16b8f7f36442a48ab10b89a240000000b215af485bf8893145aecf2998b26d490f941a4c7d6a4a578fde522d46810709826a8bee1c9c86b5dc3f5d2f0fb5f88e0963977246f502370d8b17935e682ed8 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f4e30fda67da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000576afd65b622e3c70f67b7c614467051659471413d5e977ec48d183cf7c25d91000000000e800000000200002000000068822dafcb27a2542e425e37a8fe2f422a1e8ae64bf15e10b7133633303834be90000000bb2ed784cdc227ed9afa97e1d9a6aca69ecb39ee7d915ba3f35a536a449d9037ec2edd1c66bc29663fb29be3c3943cf7679750ee5d9571a69853b758302800fa7cd4aa53fb8262bbd8de5e2d64af6d478a834c23c6fe8ea09405e487f6176d0d160258d3cb41a30a283f71d8db866aaf6d1f31054fc93ce8f10cb98ffc3cf0960b65e3c40e4449d96f1145fed9a5823c40000000d70f78586269a799e8551640052173e76da41317b964e1046d771865d4ee9d762b8836b79ce4b6afdb2d8f8ac7651925007990db2f758d650b165d9438460bc9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415020759" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2840 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2840 iexplore.exe 2840 iexplore.exe 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE 3000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2840 wrote to memory of 3000 2840 iexplore.exe 28 PID 2840 wrote to memory of 3000 2840 iexplore.exe 28 PID 2840 wrote to memory of 3000 2840 iexplore.exe 28 PID 2840 wrote to memory of 3000 2840 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a39d0702677fcb98a3f40ed2910d789c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3000
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598f3f94567772102f3035d6430d353b0
SHA12d83cdcf3bc41c79830e313a5b261ff0c74c9952
SHA256e9362f6ca2738fa75b5ed11072f1fd619f7dc9ed03e54cefd03319196060c08e
SHA512aeec14499d8ed6c39ead312ab4260cc0a6c16e0373e0d2053c3774a07349fb2bb4eec071d66b6ca7fb5a0dd56d0a376dc9453d9907c03b2fea4928ac3757498f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5970e189204360c03356ef1048f02e356
SHA138cd71d48870beaf740879047ada1ca5a42d7030
SHA256db528c3d15d8cc72d33e238161f6b74c95fa6dd957218eddd34d65867e6f029f
SHA512c3d696a79122d4ff9f5c59c70e656e4ebb1f465a7c99d1d63b12102411085cb9079fe139999d957e5df487403a6837aec77a52c09fc65feb765082d1e9ef12e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ff1b7a9a5b3a0a7abd0235bdaad4ccf
SHA11fbc9431d9d0d7cc4a7fc8bfc4f61737624ff938
SHA256f2b1182590dc4553fe3f4fd2fca9eff6a0d5b9835c2fbb569e6a5b29986a3552
SHA512234cb2310799ea3031bf9450f47064d23d54f07cf789825f7c8cd4014e921bb9e5907bf874c4f0da89123d5add365048a5e9fc205c81f1249b0cdc4cb2eeccb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f11111a0b56e3faddbe79f2853df128d
SHA1ecb4a06b5d48f4b88051014ea63fbedd40d45074
SHA2569026590011b423c4dca40351e04e58fd36d842bd02248b3ce2181f0538a2caa8
SHA512152a2ab26fb0a45985dc6e4572a01c3169fea3682329dd042a687ab0b4dd1d75b23249c07d462de1eb318bfc526ed4e721383e426b1a439b1f815856f00eb170
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595988150b033675e92a75cb07977c859
SHA17c5c1a47932120066aa5a7b41195bfc19ff10e9e
SHA256c4db368593d3ed51b558508c6e25c3189f6bf42bd73801fda77c835171f8feb9
SHA51202d0ac1843731f07cb7dbfd696d32fd89de9b43da435d688b714f1e59f9e7dcb4be91f0bfffdd1562382585c8ab8298487231c127e3c9fe8a82b9c492766d2bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576ad69b01a111359db809ab33f0c8aa0
SHA1619be13a0d263d7bc65eef2691ed69c7346755a4
SHA2566df604c6d15fd5aaa18dd8f4c272bae973c501491fe1ad819b1c549b73443a65
SHA5126b6e0a8681daa29975882321441800f36d3e40e5d2e055c2ec4a685bfb80131f3199ca2df995b61f844349b0907166c02f0d98655a3b07de32fc3bd15af418db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f345c5b1820726cfff6921cb7f619711
SHA16b04d780f7909d18cbf8d9228de273266706a806
SHA256d4e3701a26c57f8f7dd0d32fdf0a98f1a1f821d9b8f611bf10bf7c1da196d69e
SHA5124e9816de174b9a75a979754064420259a456c0aeec5df1d92b56b82442c8a5c3656bd7d89f670a1f8c58c78d908028dd19b89e850f25280f7262a77ec18acc7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d95e2d4e3f8976fb3e23dde4c1f2e57
SHA13880937162a6ca4e7fd961c30542de1f02975456
SHA25699f7229bacaf0c1129995ef6c2e2ca574362d2038b8b00df79aa3e91374be747
SHA512eb3ceaaba86cf6473db91d711f13cb004f5894bb61def4bf3a077ee7dd2311e8267a4e091c725948ce45d3c35c52f083fdbe8fdc8af219742f14ace275784373
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597c903c7ac858b2713a8bc3fee2ca036
SHA195864f787a3edafe72fc18e22b832ade9e5890c8
SHA256140f60e90981f1620af136428c9642002bb76308d407aa965247968e121d0255
SHA512a44bd887152ad7e08c58ba1bd5c847b542673b792a5a3ca8cec3fe253e1b142f3b2256d7b1e08bbb658e569ea9d6ba7d717087f978fe1f487e52682eaacd5fb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a35116201f108d2eb512b483f629f63
SHA14b7f3ab7178918867046ed6328c6e67e736868b1
SHA2567775d0d7ac2067b413af12df3c92fff7d68a97337c57c15a96ccfe327f51048e
SHA512cf1a8255e9728c0a77028418fa2deadc2d93323d0069893ebf3bb0cc8bcec503025d223065478ddc6ea8ee1a48d9ae728ced205fe03a341f89ea26fa0c26a276
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582cb0668676871cf3f54bf459ff57899
SHA11c975d88a4ba80e03367525d559f4eced4dbbc41
SHA2564b68de0a00bc845764adbb25082c271be21060e7765ac2cdaa6a4bf63e84ca30
SHA5121becddfdad6b1d70bf775462b2c49ae590549cb35f0f8376b3391b15c629b9b87f0ead2c663b306ee248912781d3a3c747fa3140c0b7b20dbadb3de297251171
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5421b3613d030383a1c66e82217fa63fd
SHA10cdf50a7f42d57e8261f575f311b84265f95f06a
SHA25696d291c7a486bd884e6be1f71b909cd44120ae77d620359096b8893305a039bf
SHA512a6eae388eb0793d23ca5c2a4e7660c8d4c399291a94c2fa26aa5685b581af54855a804e2387e593e0f5a78a3c0ce76424c32eae9469ee16ffc2852d1a324e604
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba3b7aca348d5ec51d94339835720020
SHA1061bdd3e08dce868673c08fe37d7d9e9b2265855
SHA256649b2bb13dc4679b232ace16ae9c25d5534d8a9533b7e16c14b5af362a6a4e52
SHA512a6eff10e3f478d2961e8ac0bdb7e58bcc4bd3af4be67c0cc37473ff4ec55e744bf5ca35e793d341c5aaec018c214153c3e3e3141a42a4ed20ada58fa7d64a23c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db6e2f082aa644a4156aea96ef028ae1
SHA15f1926a380a4d9c2e42a5105a9cc3237a0d3ddcf
SHA25607b4c19bd9696955956bdd6004cce81409e08220fef14db2b85205c45d667e44
SHA512ba22428a469044eed15a23755a0c30624776d615d6738e83ba7afd7bcdfe0e088109543926aecdb1fba58ea97e7cccfc46e7dfe8563a3ce0e6441b068ab89099
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcc1522152313a436056f65f9cc7f8e2
SHA1b7ba482970b58ed04da880fa3eaade8bf47dbac6
SHA2560e5c15a6b442d31a9bef156e04cd1c22cb990c2bdda0b918455f9a5673d0754f
SHA5128a6b06cc7a3a0623cc09aedf3c903400feb935cae046008ec7fed2a7af9b2881f6209948f25d5933144e60e5b1735149700d3e5ada19ac9b92ef9f5c603d2670
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dad9d330dc7d729d2d503ffbc0ca14b9
SHA1db4ee42c1cd36dc0e8d571b56406a7975b954f23
SHA256bd923ea4f4f92adb10ca8457bbc51c44b355858289064bab456a00b7173aee42
SHA51220fe8a0affe468fdd706093c3c1cd17491bd6f35a488326a2bdf72d27cb34811a1eb05cdfddc08d2ec065713f3958fde7daa185c1796bd8bf70b25ee6dd2a264
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567f7239fa021349d8a9b7a09683de78d
SHA19eb9d506d03fae2ec4fd8f47a48cbbcff3a04544
SHA256ab6e5e731e8fc23895ac022c6ddfe8a763500d127d40cd7b34d288b0e086b101
SHA512e5b3a18364cb16165eb220972a2b1569204850c2e2ed8e4cb4996a8f0ef095ec3440825926981bd2285a16f83a9266833701979f2ea6ab4afa4f4927735ea764
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a00ac313bd251c4b3c00cd081e12ec6b
SHA1cefd0fd93f493b82e755e934b4b2300f71babee1
SHA2562e2d568cd168b30a4aab2d213a9e5032b378c93b61f64c71088971ae6b3005b3
SHA512fea3ab9695fc6c911b97de6d700ea80cc38004ad0d6a53449fef4b2986dee63ead44d182e903afe46dca5ac6529fd118d04e1c77abc42674fa54d90fc0a226a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de383f5febc73e3a15585cdbb724967d
SHA1d11609c438fe7bcbd3569ef4e9e2b84e23a5ecd1
SHA256dcc5f96417318bd2ae62b2e6d853e23b83bdc0d071204fa4e0e78756544bccd7
SHA512860cff82af60aae7933d6b2bd1f1380cd8d30d2fd91ccfe49f41145579f55544b498976ca1e9c84b956aca6e11803ff7becadfd248e932fb1b81b82176b09491
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06