Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25/02/2024, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
a42266b34f21998af93cefb0d0f55568.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a42266b34f21998af93cefb0d0f55568.html
Resource
win10v2004-20240221-en
General
-
Target
a42266b34f21998af93cefb0d0f55568.html
-
Size
2KB
-
MD5
a42266b34f21998af93cefb0d0f55568
-
SHA1
90b700fcd3616e39a2f51f20bf925701c3def8b2
-
SHA256
677cc36103a20d7a11c4a83cc8d978e995d8354474fc92c2f428218bf083365f
-
SHA512
0c9b46c291a64d7b2d5218dd1a111a07c9ea8801595b56c57bd0e87b4a9a9e6869fbb3413d5cf6d960aa76f7a0b62807125b04d1ecb6c07d41821645eef7f8ee
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000004a015b1d76d8669202d7a8c3b2b5ca66ae8d8d4b17bad9b2a95212b6a24cca2a000000000e800000000200002000000021e297370acf5bd4aa6cdacb6e6184689c3d03d03d610c4ca12b8b4761969fe9200000009d071a6098e3488aa78e1482a6ad9e390631ce155c505b9c44624ba66c2f8c8c40000000e16e168e64202b405d78f1aed3ad2f50091917fda94e5ce6c38271d10c1cf1c12ce7f09af9d1950f6245d94e8a8d1d446c39fd0dcf6c5b140d32eb435dae841c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79C52E41-D3F2-11EE-A3F8-62949D229D16} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000061a97280dd74534476ddf964997c7c849ec93ce995d2784985c16912e888d45f000000000e80000000020000200000004e066847ea64a413994eb6c7319998b00c6d213c8c80417cf72bcea68a2d869f90000000b0a8157f82a20adef5a70a3d05c06dcc4319ed1920f512ac25b4c97b19f1046475c3e309e2ed337316c4bbf0fab497ee9ca3474e38327a72bd174c03edbd6e2d3632e1fe383544035deef847bf82dd49f07ab78563fa06a83edead66b9a69fda63f2711cb5e388c235c966c41b82eb0b7d8412cb8041618077b17e95a14f42e6fac13a12f183d724ea472eebbe0f937a40000000851006f9f85b9a437172a2af92d7f8e459de28377366a54402c922f546ee7ccfb222ed6c31666d3e1a2681a8fb237461c36bbb02b91ac619ccefe37ea6847941 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40cc2a4eff67da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415036755" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2888 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1992 iexplore.exe 1992 iexplore.exe 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2888 1992 iexplore.exe 20 PID 1992 wrote to memory of 2888 1992 iexplore.exe 20 PID 1992 wrote to memory of 2888 1992 iexplore.exe 20 PID 1992 wrote to memory of 2888 1992 iexplore.exe 20
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a42266b34f21998af93cefb0d0f55568.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52245fc47abbb6e8d446e5c7120e9e6d2
SHA185a8d78e6ff6061dc359d47effd71e74268a93fd
SHA256cf176fad46443232fd0e3f70db25f9f051db30b2da65329f1d4903d7cfd152a0
SHA512a9abd490c008ba723663a3bfc7be4966e0e3970228ec4eceee4014f6e1241cf345c9fbc5594567387a9ee367b9910b1efcb84beef528b681eaaceb82d476466a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5babd73fd5faddba8c58c67d822987b90
SHA1bbece8d73934bc85fc748d2ff977c511acbe0f50
SHA2569e3f9acfa250ff2fea7708fff896556122645e82da22d5ff67fd265968ff886f
SHA5123f8590429388f7cc442a926b4a4d392cc4954361ffa161d090ffa8cfd785c4ebb840ec13990814e681926965a6e2e78f8e4ed998903f715ad5ccb15ae38092fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb5859eec385c3bfdff5e9368d26c68e
SHA1114cb031c10947fc40c6f28b361a7951f9411703
SHA25608780441fbfd33fed06c61f1df3aa94b70237d209f361f1379bc839ae8280142
SHA512545b96e84175c92294d492e22e817addf2b7a197217202ab3a5f9d2fbc1282d7f6e2326a5f78c9b9822e741af88ffb928ddf5a585f0018c8e385d8d454d68ab8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521bd9f0a65845142bd37028f4b80cf33
SHA14579aa48895daba9c9b3fa51aecb156993d118b3
SHA256ea953bea9ce07ea4bc261ba61b7ffd6f506715063f6954498107ab0988a4ef69
SHA512e453a275032315ce769f75f6cde005886a67be35414bcd4529b14a888702951fae21df3058cc3efd5d88431bd0d69b1211fe694817aa9ad4578019c4ee16cbea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5a2daca88f3800219439b3613f832bc
SHA1ffd763ef402fe4eb4e0749d880f2a4c3d57e9df8
SHA25697d84fe373dbf90c72c4c70cb2c02dcdc198090d67ff29dfa1d0517f353f15a7
SHA5129c7d1dddcc8857ffe2a65cf36458676159fb45a3c4532c4a1dc9579c0f636bab9a35716b290a8d5140b80f3709d99baf3a32d005f6565e88c7e9ab88b8fefb86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5747b7f98fb5cb0f868bad5506dfaa9d7
SHA1804e0572e4c89783e099c969871d798938a86ff2
SHA2561df9c3dbe6e5d234318442dd2766fe36b8fc42a82cfff2563a862274faff2752
SHA512707858d7807ea967f50688c04ba0512f3707953fd780d0488d4ff99eb5c7690f11c8cae10386c9fe875ea396bceb3cf73c6dcc71f85ab9d837161a3f345967eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514e6b6c595bd553203d8a7944cac3ba9
SHA1933f0004ee71eec518ac1fb6be822ca75bd592cc
SHA256449c6a07016fc79fdc58b94890625e7d435733f7c060e7775ec824a8181fa4fb
SHA512cded239488e0e16112eabacd4dd6c97a6b8b81c14e057c050dda15797c32b3f26f3bbd2c2d95575f5feb439292705bcf5074d9aab9640f5d2f6dc187cbe11ded
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e97a3db6238031f0f7e18f3baa0033a9
SHA1c02432902cf6ebbae40f8b75ee747592c700b285
SHA2564aadd67ba38cb7b84c1770ad5c8211e37a5071bba04ded70f44a5aefc534d1c1
SHA5123806c81af266e9a4a0460a83082c276fb384da5a526cb3c7e1319037f4b4a857ef0a892063bc2e30e5c5e7893a76c08a02b8be2aaf01791b3b3ded24d2441452
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1b9553073c12d227cff0128a37316f7
SHA1e631340c470857a411242899b278f4348613fa06
SHA256410aacf3b30ac5ef4f1cc3951dac63913a274f3449b777355013c9cf5a861239
SHA5120608dea506c98396c9e12813828263aa09e35318e43556e01a76ddba43615de38b9efd3483358ee7e0cb10b9746ef785b92d26f0f63f1e91c8154d36daba0382
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d81648163a9f3e0593a62d590bf6f8a
SHA1745cbc359864fd4f94cda89f8501db255544e499
SHA2567c37aca805e424984b89033a75e4bab57011162d81f1e7615b394c47631f67be
SHA5128ee2ce485e439ec8fed3f5528b9ccebd0539e74964e472fff1774e0ef0ce1b050769357c4fdba6ff6c7d0edcba58aa77758b6f0847530334a90312a6289bf609
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5402c2bf22bc9ebc1d8aa82a308eda818
SHA1de253536a318c3c6b67bfa41d95d39c7df3134d5
SHA2569257c72099aa54ff3419c817551c1c03e9bafa42d68eca48cc3e468a251ab8f3
SHA5124e741dad477d40ac21f0c8cf6c5427d2d783ab8a24ce75ecba3ee52211c13d9402f020c279e26012cbd9d726bbbfcca07a219c327a20b05db94b62b09eb78758
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c23af3d720d42df09eb315cdc00242b3
SHA1a70bd5f6fef12ef2a974db8b2641560391beacd0
SHA2569d751391537335ba683ac46c7124d2416ee0ec24bea00a45bc00608d774ce0d2
SHA512358371cbe493332750694364bdeab3bf0fc611c3b6c2c04f099c2872835a4749138161f84284bf441123b87bf709da2977e55b8c217f0d4d658f60c5ee479cd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fff017649c399acfe650cd6041b98a84
SHA16edf4af12db21aa9c4f39d7cf8072b455ed35fe2
SHA25665610ed0c2ae9b78eb59cd1f1ac69bb9b65e34c4f33baeb9577d45965fda6c46
SHA5124c880a1f9d290ded93447ea56376ed6b561fae3c9928d1e9c7709ce8ad86b465356735dfc61e008a5a5fca370073fe4a74e1cad5df880dba656397c06f0dac7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3cdd7be0defe56d0c4665f3258fad63
SHA1c49ea7d832d7b3ee52f3969e5e37ce32c3c55f6e
SHA256537304f5ae796de227e712e8dc8f4a4b20ad969dee310d9bd310dfa582fe52ae
SHA5125cd14e93333136ed40e4af5f297a414e8e5f0c6275d034fd668426b3439c246236136466f3b303dbab229c2cdf9a67bc0ddef9e51a0f53747c6d6a04797c348f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af870132b24ce3fae6fb1b2ee5816db5
SHA11cba4e5722e76abc1dc60979ffd4d2e8f444aff2
SHA256f06b3df28e206f028616934a366628f189eb43a46d9cc777b3ad8d6d7f21722d
SHA512e2fa426f8a4acfd433b4a4e6a664ab1a8e1366e1dc6648df8c3d67d29ec26971b0921a636f90bfc387a244eebddc88563ac64f0ee49172a1dd5c99ab3a697d99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edfb8722f96d6c2a40334c14822958d4
SHA1a67d8e0cb5c0c69ca79d131916383dce42a33438
SHA2569d6e54fd5987b20ad6349cfe6c9ff02c1b17241f8bd3bf0f5e7f7d292681a4e4
SHA512382dbd04921637a74c3f54f4bf84cb189185adef8216dd622f0d047c65ed300453028aa09b9dd9745a1faa0eceafa005003f8b19c259ae449b42886181b20327
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d41cc2236717c70b07d4c30781a23159
SHA14a85fdcd7e78310df42808f5f52858c25bc04d87
SHA256ba1c46e968df727fbdcf05a8d825df0baabbd8129b627cae1b1f2959054ab175
SHA512cf879541a464d26ef709d8efd46d003e7dce3e2888a1378e0aa54b20e0add17007a2060a2596efd9ed71e9e181d2988d413e6775874cf9cacdf586dd195254d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b61a8e4921364ee7e9fcc1e03fd08031
SHA1af28e3357a9acb30e615fee038fc9968daccd223
SHA25677bc895941e805f76205232e55f771464214ca960e95fcf5610124d6e7227f83
SHA512a3e5a269b2b298687ed1f6976225b4f39519850d8f4582a963e179105c6545b2e51caa298058a961d13e26f1637569a2ecbd3eae4aeda8031452ceac8220a6b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515f8b8e610d1f44fe5838f5396734ea9
SHA1f04e9585ad269e5389ba1c9ab7ae9b77b6ed4aa7
SHA256fd522aaac5483d76506aaca1d052ec1578148751db1327a72124504004504ae7
SHA512cac5eca811b034f66c7d00f730c2f34ca0f9bd2ac2ca0b746d1723eb6ad0e7245017d6f94b420010a483ab1234ce78839372c41fd56a5da8720a9f1f31af61da
-
Filesize
64KB
MD5d71dff97ca86ca16c3db8bdb5285fb35
SHA1271c01246897497d069b81ed37af296cf6c1e498
SHA2564a19255504acfbd49c4e1aed722c7e62b50b5742b860eedabc5f46160f8aefac
SHA5121fed2a183296b563e35d803927e539d28169895f6ca5b522a1c714f222a2d3e578b1e167b19568b5ad4800b898f7ac041c7bd8f6bb02d1361b32cbdcfb0f682a
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06