Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-02-2024 14:09
Static task
static1
Behavioral task
behavioral1
Sample
a3fb6c99abfa77e7280fd79a2ecbb849.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a3fb6c99abfa77e7280fd79a2ecbb849.html
Resource
win10v2004-20240221-en
General
-
Target
a3fb6c99abfa77e7280fd79a2ecbb849.html
-
Size
14KB
-
MD5
a3fb6c99abfa77e7280fd79a2ecbb849
-
SHA1
d480c455ba2dc3f83562b4cb3e5b2b6fc48b8554
-
SHA256
9c7639fecf13958a43bfb407e86cf0e1fe21d5b50ee1f8f1bbafce001f11796e
-
SHA512
babdd27a24c6a3c20fbc2bcb6c6eb6db6da8ff56b3d185ffdabd056422564679d9656e73d72a72e3969140e9b95cf265065ac73a2f3d1f156d6419c1bb7b16db
-
SSDEEP
192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vHmlKt6DvE:aioWD/ZmXg8SZQ+mlXrE
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000c5a02e86829558f3927d36382eb85e89a8abc3ec1963f1048764b4d3d56023da000000000e80000000020000200000007217d887122b84e70523b43bc7b66ceda90b0886867cee86c054449a9103e33e90000000886cdddcddbc0fa9f83947b423ea5049942682c97cc1f002b4ae660bbd3e6eceece51bae7aabf68d65f9537f8b759a17f88b9fe07567eaba40eee30eb00223e68544c892617fc5e4f5233c7a5857f927434306779e22dcdccb6f6358ea29e13f7c8be511bb201bbee87daf3480bc984179fa236b6d02fbef50a9069c70f3c8889560e52377066e2bfc6fb974b2040b7a4000000071b67420e40336fd23c59b148cb1d88b838ec55d45495c2e7f316858ef694733f0db66b6f8e3665f2a10ad324e46c21ffc8e9b1bdd626c7350459b34e73edbca iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F771BF1-D3E7-11EE-9FEE-EA42E82B8F01} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90260c64f467da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415032067" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000090ceabd410de8448fdd7d773aa55342be8fa4a517a5d36400351c54ca802bccc000000000e8000000002000020000000df46c1378154b32ff32cf2fd2a5db84d85bb7b20f1fbe22f5ec1a381aa5f4df820000000a5d606ac9e1a0026eba932cf76a101139a282cbd9eb8acfa9939c00c303bfa0d4000000061121923417708bf841496ed6c857e43b205c7a0e69c5817b48f3714f7d3dfa6ef0461155987d57045f111c32772d682621d6b894d8825ee6f121e109df0d04a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2908 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2908 iexplore.exe 2908 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2908 wrote to memory of 3024 2908 iexplore.exe 28 PID 2908 wrote to memory of 3024 2908 iexplore.exe 28 PID 2908 wrote to memory of 3024 2908 iexplore.exe 28 PID 2908 wrote to memory of 3024 2908 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3fb6c99abfa77e7280fd79a2ecbb849.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56636126651b9ff6fa16a1e0a81722449
SHA12c7c8fc7223a39b7583391e514f0c5d069e0da43
SHA2567b317bf10e6528b68fc78a942f16da01513c32c96368f511160fa8cfd7ab11ff
SHA51267734c0fa99ed036752958b3a2eb098d88403b5a4fd9d9f06bf8590f2532040b7e59bf3792e0d80b0a50c4ce20051c600d83f1012f44def3fc558dce7189724c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e195b101b93a00924fe215a8fcf2b757
SHA183a4af249a8a4f935d49441a810fdc242d3dda32
SHA256fd6714a046740d5d1dc5958cc05eb19e20de0c2654d22404e059419459b53d1d
SHA512baa4ed46681d2ad5af7dd8c19368864b8a17bbbf7d250f8bd39e512aa1d49bb4f0dc6b7d0a3e9e9e0ebdf98d6da7268370b67e4e47998e351f4aefca5163267f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5caff936c701a9c0e075bff546aee4d64
SHA165082f5594c6998216378e8cdd112e46e5567fd6
SHA25698da8f3aa96cb720dbb7176ccd4b1788a48c20acdafb8fb16921efc154753ecf
SHA512c0952a3e78a32d5166bc95f9f1695e4a2ad42fa79de4fa10ba1e57de7021cbbdff3dfff5a2eb31c305a5a87b76a4d0ca317d08e3457381dae226c6e5f3aef339
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dab9336c3efa2c5d76d2315b409c428a
SHA145257c4953027bdf6160869faa89db7238054328
SHA25665739aa5472f3aaba51352f0081d05763152c10bdfdc752016a2289eb9f50586
SHA512c0f7f979384de1f7eb5c4b043b0360faca69a1e03d9a87c5301a5dae2604588d7a736c52d5ed0a7d17dfc4c21f12ffb30d04869ec7a233ef1d9521498bf414c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae840a23362d810824268fac5572fc4f
SHA1f60a35c331c418562bf3c11e5d548b453ccdff4b
SHA256857a69d5d166cd587963320a2687202e3812ab922f61ca8ac720bdacbb105b5b
SHA5124a15a1ba3e26b9a6d742e8d5c5e8ae5fd4dcb9f085aef1efbbd579b5c39aeae69dd2c47816823da7aff495544b6ff8346f4e955db2c94202e678f967d452be2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8e793af62f973c9a66f9516c51970e8
SHA13ab6df2bb8ee23817c27f8ea90376b7f5cb1c99d
SHA256b125790674026ba6530cecbc63093b1ec9ba6f82ebf0aa231fa00830e4660d33
SHA512b4de714d2bd21e392081266747304eeba3430123227cb7f67fe51126b5cccd54017cb9af6dc2a3a35410e5bbde375947bcc7fb89e0fec97836042c2007c47cf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3ccedcd3224e413289921d059df9d46
SHA156745b2828c8303373464d1b35ac97a0a8edf3f5
SHA256585f5221369b07f921f7566a4b091b32bd99439fa64d190ea429303ac1631b03
SHA512561df732d8c83a41dd01125c5a767cd3b97c6a9f7121189d9bba6a16615a667676e653c20d896478e75c385ddb5f3723b6aaa665d46d813b906e2eaf91e17865
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a347c5df8f006c616fca84fa0afd2288
SHA1389b1969ae7fa4f694ee4df7f239b2d8ce35e9e7
SHA256222b63d7bab2e8ca6900ce4a56abf85a2f0fecd9e2beb42f310d22823a0716a3
SHA5123c9aca1b3d8cb1122f95c35a0f85a0f707cbcb059e783a6aeffc479f9a18ff288d93e735bac09bbe73d2b72a1914ccc034e30c40d1aaacfc0f00ed4495967b38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d64d84148b2bf8a893ab7b77bb7e0d6
SHA12fc5c55d1d72becc26a6dd48670f82f30e079998
SHA256df98c096c6f7fcdccd317e0ae308ab976d41c976a6db23c8b3314b58be655eae
SHA512e4fd49d7334e8e0bd6e179891c9591766994041af5774ebd4850e2dfe2e7b622e2d22ff53a369108ffc706032e0963d6a7aea6de8e92c2e619d7efb583d66816
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5127c746ec5ed6bec9b979b11bcc6128f
SHA1b30eadb11299191b010ce5bb28289d2a4252cdc3
SHA256deddc4760089ed2c9b6720a593524bbd54811d20d488a6a3574cd666a8669f6d
SHA5121a1a5c92709338c0b86bb553d3bef6fc78a28c1e415cd9b5d9678b4e3db2e4444da5056d13949b0c47ce729856f4805f206a7eda11d74d7e002760732fde9e2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5280fcf86efd67947850854412934b40e
SHA1e14f52cadca9aa18c03f9ff27c41862ef8034b0b
SHA256bbdd539b78992f59a53c94517ab9a0fd50ddd631462b606d4d7d5e780660d982
SHA5128c5f94b81a52b2f7f91b651b2f09b4bf0d531b06f76b75b42e7746f85a12ff1446c2f289d725aa6a447a38a3c92800c7f0470438092d6088f8833ef33ffadb53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526e92029bba6ee8b1e1d7d0362e66c83
SHA18220600dfa5378ae384057d5a66efde681d99a92
SHA256910fee0c1e016450310c6f588f6c2eb5501ad3c4abf00a35da26be23a9a66d5c
SHA512f0ffd4f0186f07a99df24d7715303a172b6789f977220d3657bed02228f945549e807abbfdd1f50007c319bd5b2ffb2e167b9de01892045140fd440ce45be5f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a12732c061409b9170592f70f22989f9
SHA1dfd5ee51a8d47f2cb6cc9a6079836b63b0e75ca8
SHA25647509e4c81e770abef44cdffcae3d5bc0a844f0b431ee38727bd4421fb11a4c8
SHA512a4314ad89b518efec3d821f8cd77f3f6eec1d8c46591ba8c33d9d1f66b754c4dbf3820ea5ad079674254ad5dd70fb50329b223c2041b49aaa77b04a0aec54a32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5802a4ee60120d412ed048f625e371f00
SHA11c37ff225f7f129ad5e0d17e55c0c18687e67663
SHA25695edd46209f1f0e831ee6bea2c2d93081b0dec499ceb035123200657a2ab8c9c
SHA51266af9f08167d996ffdbc704c2c5ce09100de06a9c747f0b4bbdc7716ee20b45d4d9df0ed028df072edfe71936848b4c0e4a82100928fb4435721a4e441225994
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526442fcc816ccdcf38367dde166c3881
SHA1c7a0a575034b869e15e0b89b95eeeb7bcceff4c1
SHA25653de4e3e0340fa3fb17ea510a9661fe645fd9056d6607c9b50ec2cfe6d77a53d
SHA512264003c28f8ea509eb488e6e354bad14dec00badf1093b4e5d61505771a6cbaeabd92992ef6b4fb4799ecf87b12e7f1bfc96e04a545bfa8ca8e4a5ed9c45ab5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd4962494898831600428f819e2345e8
SHA134758f970389d0f3edbc6d2c41c84a60da9a5f54
SHA256badf2d3852c717621688419f915f1de82fb2f542fe030fa1d8407756c755d7d7
SHA5122f6b2b4c3a07a5d1996dad411907778ca438b268217ba5467ef997cc6e54367460c5557c6b981310ba9165a90d599aac2a881ef7e0115b69a6d275f9cddaa058
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7fd04fb7e3951e426dcdcbab6419ba3
SHA1cb1d20e11995e7a86997966d778af7103965db0d
SHA256ca8950057c96b3a25eb1d77231502fad3fbc48889e03f0523d1f68bdf9924fdb
SHA5123f86ed303a30dd1ac4b78176eb567e950a67dcb50b2ed7d0248ab59e46f5154ac7b34aa07d8b4bf9762c7839c1f4f8066c785b6effbae4de53f809f6d614e728
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593f09671849223bba06c4d5156b2a325
SHA135e6e5695c77880ad16425797972f51f034321e5
SHA2567687cc1eb8f5007bc506515ca1d9cd26ca174aa5f8d9d227dcdb62b7dde54acd
SHA5127f2fc1ad6b12a61f94bb58f54a2b4e6521fff51082248ae8ede7904aed191f8c936787ce5861ef5d465a04797c059a44a804787b27267c2a2e243e5520ab06e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5513d680093ce71d5eabd4f16edf342a8
SHA16e066b32094e22d40f9739a59f8af128f6b61812
SHA256a1a00ea443908dd4cae8c7bec4741384decf708c2e3e84846c7b15b30eba10ee
SHA512f4ac32253f8cd7864d383777e846e2064441a9418da25d4541d732c6103941933981e30cbce50ea3764543977c90abd690f40d21f119bd235005e95ed640e9ae
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06