Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/02/2024, 15:37
Static task
static1
Behavioral task
behavioral1
Sample
a984da1c0a13fe1c1ac0df0eb255d4f0.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a984da1c0a13fe1c1ac0df0eb255d4f0.html
Resource
win10v2004-20240226-en
General
-
Target
a984da1c0a13fe1c1ac0df0eb255d4f0.html
-
Size
44KB
-
MD5
a984da1c0a13fe1c1ac0df0eb255d4f0
-
SHA1
fb334bddb47e8ff138b4630b86c699efa2b6b199
-
SHA256
d89d40b0075a95f5cbf0c09cf2d79d09e5d656f19a20107acf97207f5f6e7468
-
SHA512
a554729248874e17097945c5e730d854e4d93978d3538e0cd7d8a456de293fddb25c1f2eee1f9200b94689a3bfa3635d0557079c30c09f9ae1194613f89eff30
-
SSDEEP
768:EcIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZw/:ZIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqR
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000c4ddafafb1837c1324d145baf5bef1a544e1f356e6f4f960de4ec4c361763e1c000000000e8000000002000020000000329bad7dc0994a90b75a233774f422e7491da34f6d5597c4a2decd23e9b0cb9a9000000029987f695bb685155538f4ae74c8d3c1b78f36fee9d0a03192682a9a7dcf43984ce7448414560172419eed15377ef359de190027ef63013f8c8c55eee594087d7bac00a790d248e1f5850fd7f35cdb61ff2a99331cf9686203e4a195d5dcc5d2be020b45a83c7e83ac6f58a75247bae83594b6c679eb26be664a5d0cae65515d132adbb39a087edb817f3cd7c5050aac40000000379566554dd66b5536fc9097f810b4e0bd075abfc82b05a6bbaa678325be84c80dda2dfe2900abe4f3c8e5c032197c6cff17b14ed33529e5b391f11928f680c7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807431f29269da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415210115" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A945A01-D586-11EE-9F01-52C7B7C5B073} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000df4db61261ddaf4252e28c1e1018af34e3ef071b6f589f595371e46f4924ab2d000000000e8000000002000020000000e3a0827b640377a345e6b4a987227f38fc3db5ed2144c949a23e429e3561ae67200000004ba60c005280724e10dd2fbf2e486737f3e071d688fce27bf0c2839e7a3a5aed4000000015470484186e776cc099d9a5e0f566a2dc6603fcacac1e53b2df113daca49fadaaf007a2a9c3d76e9c8bfea3a97d2e29c615cb679d7a9de02673397db3d93299 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2756 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2756 iexplore.exe 2756 iexplore.exe 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE 2888 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2888 2756 iexplore.exe 28 PID 2756 wrote to memory of 2888 2756 iexplore.exe 28 PID 2756 wrote to memory of 2888 2756 iexplore.exe 28 PID 2756 wrote to memory of 2888 2756 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a984da1c0a13fe1c1ac0df0eb255d4f0.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b93f6f5672fcdb2ab31282d7b942ea2
SHA1b31cbe0b25f6d23a7e64d14f460eddfe5cc1db0b
SHA256b8f104b27a1059c08c3bb67ef5bd0adc212f955afc57bfa7ad1f62c7e6a9f7bd
SHA5122d6f412f16e15ad2625091aea60fedb2c1edcfd245c04de4f5bb1d3af0201234a62c5483a604bf96f49bdbdff9e119b054650fdf32b2c97d790d6858870586db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54859358c1b481e5455bf5ccbdaf81331
SHA12ffecd3a5505bad4f6c94e84c713f90c56098854
SHA256ba5652a6edd8af408516c94a3695d4ff457212145823b3f417b27620b5a04193
SHA512facdac2eb20aeb74bf6f42990105d64cae35bf659d31406183fc9d4667c6037cae7ac2da0b15ba054db657daac75c3c9a3390a61d8928a0a3082ad9d3d391812
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9a5044586990c188ed7a7f8524c7f28
SHA17f1a8d82f1102a0f32d79a28fae52886f1680d11
SHA2564396450f6472bb889a87507c88c12a49b018b082dde5fd19cb418f17e08b15f8
SHA512137e1b2260b54dd3490dc12855a24e57ff6390f7fa61ac670fc13859bbf24c022758f0a1d22fd02d5bfc6dd3b345ae79accdcf94221e3cd7b86c0c5b129cd08b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a464e51bcb8338f2d09f947a1e1a038
SHA19b8fc6d283b9ad3589fe54b0ab73d60b76539694
SHA25688660eebb2ad2f62714004cf252f96156e6595eafcc6bf27dbcbb1fcd95ce4e5
SHA5124de3baafa10966aa3142bce77d7ac4edeb2913af2f710330309f4046e97584e5c39754ac1bb76f69c7dad8366a7f6d61f24e0e41eb7f3e58318e6f189353b67a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583565ed9db68e09c7d5d7befcae0c1d2
SHA15f0ef325c35f7d4faa7b149a76eac59494775211
SHA256da74198e9628c14562f7da0269499a6a5eedec4dfd4cea51862e2984ef9628df
SHA51243d127e590ceb7357eca18d9810b0d74a633c0a9d29106155ac37de6d7738f5e581472893322a6dae676a7754ee4093d1ae6a3c9380624e1fb6c6f83fb954c23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561951d8c1ca81011cbe8b93d9913084d
SHA11d0f7d5f490a4fe7d89163d68e1156bf1528228a
SHA256ecf7294730f950d450ca95fdc5d3f22bcb87a18b8948e3afdf36c4fa24a52214
SHA5122c8e484e028c7eb87b20f739f9d0cb06cf72a7a035e5fa5f10d614827e8d146fd23fa568faaddd6b30e75b442ec753e04fa9b52308446134744128d5deb57086
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546b389c249c92b1a51f6e48b838cd97d
SHA13801009b1cece2eed55ae98cb13954282febbfcc
SHA256a66a53b13db6c7cbfda76e7f6b2540e592169fd850068e00016414e6b55eaee2
SHA512f8d323061296b554ba34d43dd5db78b3326338c2dea2cec232e22283f7f13de9d2b5612f1cea8518ae82078802b0a4efcc9127431d09695c7c6360c2497aeb13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ea433e3bab752daf7c13f7496bfabbe
SHA1fe4b1996e793e9f2bc9ef20f093c4eb74523965c
SHA256f8f2166d734d1f6d1eb0aed8ea98677fde1ed918ee0d4e6aeb0a124e28e151f9
SHA51271e02ddfb6da0d0e0fbad4069ee745fc04ee20789cacd19bf03e13ff109f33a8ac74ddfdbf19ff80d2bacc845064648427a9625cbbc45b926c655dc787283e45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4e3ca6cfc743488833e6008ddeb8728
SHA1239903ddc6c84d0adede57c2ae4885f4647128bf
SHA256297f4165a47e92f070e388e98ea44df49795f1083ab4adddc631207758edb020
SHA512ccd6d6cec163f88d4f5e4e77721e6a8c4cab89714a9c8ef8407a33455ef893eae99693d94a99b399b18a90a21a4430aa0ad68ab2a2c4f44b1d6f188b5fc8ff10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5920e368451394d4ee15c3d2ac9b46296
SHA1c4c8868c2f4bcd687714e22f3dbbb872d523fa03
SHA2566f9ba236c48afee6ad1c04e2b8e3b3b7a0b27dd5b79baa85a4e93622d0d31eda
SHA5127216195ca5f4ab1b202f099ba9ea5522fd4365131279bfe73f378a2c13e619925f7135c7fd33e986d1f271322a88070f3388ad6f6ed8510f5954064470288031
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522914ace0bc6a33ee8879760d7d80023
SHA17fed120e3da1a804a537db0d8c30d607b462382f
SHA25622acb2f16b05c9d2a173ca2e35782873dd9a9d8e62fd86f304b516d8e72d3036
SHA5126c672f1120a2ad9040d2b0183b6de36c4738c579a57005978a5980eccbca0b714df6f04d2b7a3f2f3907b0687b623eccafc39a2d3e4ec62f04aa89ae96e3570d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e283a19c68b2d0e1a5dd23613810fb79
SHA167800f69143fa868c3c28c99a3be3b1bcf61c99f
SHA256e5b85d788f2e5e3f64866763bccbf13bb8fe961dc52f2e1c9eee7835fe7142dc
SHA512488b68578797714e70333c5b0c32f26c73aa52198fc6350335b0ecb21a93c71a15e9223f8ca2d57a8ba58899a9c924737630e6cf67d4fb277769dc20ce1c401f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51873a1190a57aca1d714023617c5ddc6
SHA1a4d3b5146cbc575eeff5a2dffd9ee5fd3ad62805
SHA256199ca376ea38cfefd17d53da272fd234bdaf8c7813796bf1924cbf895b8bc289
SHA512ee1c35f332e8bf5caccb309f9514498bae7272cab91063675f89f7b2a6798c547b543d02ea4276a790d5fe1ce481466aae5ee21efd13ef5f733079688f2f4884
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516229a54b09e0bee5c1019108809ee1b
SHA159c4b2d517d637b6b28fb9c465ecf09e084566a7
SHA2560fd4db6a18c027761bb6f7da96b25c373a4f9df86f44a80e1862dd0370a7e939
SHA5121c81d9ba2ff2645fb6a47478df47b1b364a15c74fb398e40a27d5700b2e62ef9b0e14484dee315a261ab8b8fa1d09746e351ccc40a98a0adcfb056c9d0e3498f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55300e5711a10ca0df7eb93d332ae46b2
SHA182124df6a6f61d9250c51b107438681db5a08c3a
SHA25695c8017dbb11d4469f1f46d36ac84d954cbeced8cfed53f6435a094ea0975d7b
SHA5124780e4b20226289134335411e96d5ffb169ad759295dd0e25515015c48a1694d0cb48bb48c4605b25c7e1343d25cc31ab098741e11c801863ed5ca87a36e9bf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc772e0df23530380edb90fb0a3f1bb0
SHA1c6ff9798d2bc13ab46c4a345476cf156b2da0499
SHA256c0036d205d9c010e508cafd0ca426d0e61aeab5e9d0d9427f274d358292ba1f1
SHA51263ab33cc863ffd62c0c2cb3e10ad8f9129cb44cd80054f6dff6cc6a7b464ec72808c8f7b3c7fab0704c4ee3da41aa1e0934543bde37b2ba467049d452d1b4635
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f96d8eee5196cb4fb88fde6ae2cdb9e
SHA1ab4d06cba347d4c74829b7a9fa9eec70a65939f6
SHA256f7b44b370d63ff8f63ac44cac0a52ac10684f6d5df15e44202c40fde456d8c05
SHA5128917e22065842367c27bc3adc278c019ab82fb675e81681e1a82421e566fb1df212c866318d7f6d447ca7460c5d5f897fe57c155e1c44a5dca0bc660e118b36f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54677f7762ad52e26d4137cd12b6f51fb
SHA10b9c28ec8bf5e8d9c56659c53d7c3e9de1544ae3
SHA256297b1f2b628d3d1e66174657fc379f46a7738bdcb6beda51de38c3e41e267479
SHA5126b0622dcb7cf84578bc360594a32d102383ce5dda5112407fc67618dd4ad7bc079e82be53393b10c0562e2f57e56561c42c890c8e8750262e382d1062830f287
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5795e496cd5b3cb23747c4b139cad5085
SHA113e9707cd97daae5da10e0d69d8ec0dbff1d1fbd
SHA25665460d1d51ab9d06712c8af51b7de3fea7c4477a0ca370e99524eec5b14d5d6a
SHA51263bacd2e25b799cd2073c0dafbe992c76529a939aeb5d135914c2f551e814566be221ca6939fb025a72b36d900026fb8e389b90bb8582d798aa3f4f7d07f2de4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06